Bug 1226359 - VUL-0: CVE-2024-35325: perl-YAML-LibYAML-API: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c
Summary: VUL-0: CVE-2024-35325: perl-YAML-LibYAML-API: libyaml: double-free in yaml_ev...
Status: NEW
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Major (vote)
Target Milestone: ---
Assignee: Tina Müller
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/410664/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-35325
  Show dependency tree / graph
 
Reported: 2024-06-14 14:13 UTC by Camila Camargo de Matos
Modified: 2024-06-14 16:52 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Camila Camargo de Matos 2024-06-14 14:13:35 UTC 
+++ This bug was initially created as a clone of Bug #1226342 +++

A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35325
https://www.cve.org/CVERecord?id=CVE-2024-35325
https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35325.c
https://bugzilla.redhat.com/show_bug.cgi?id=2292350