Bug#1059316: epics-base: CVE-2023-33460

2025-01-05 Thread Andrius Merkys
Hi Moritz, On 2025-01-03 15:25, Moritz Mühlenhoff wrote: I had a closer look, turns out the embedded/forked copy of yajl is actually so old, that epics-base isn't affected. Closing. Thanks for giving this a deeper look! Andrius

Bug#1059316: epics-base: CVE-2023-33460

2025-01-03 Thread Santiago Vila
tags 1089319 help thanks Hi. I planned to include a fix for this in an upload today, and to my surprise I found that the available patches not only do not apply cleanly, they do not apply at all! (i.e. different files, different functions, not clear at all where the fixes would go) So this will

Bug#1059316: epics-base: CVE-2023-33460

2023-12-22 Thread Moritz Mühlenhoff
Source: epics-base X-Debbugs-CC: t...@security.debian.org Severity: normal Tags: security Hi, The following vulnerability was published for yajl, which is embedded by epics-base: CVE-2023-33460[0]: | There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse | function. which will cause out