[Bug 1400736] Re: CVE-2014-9130 libyaml: denial-of-service/application crash with untrusted yaml input

[Seth Arnold]

** Information type changed from Public to Public Security

** Changed in: libyaml (Ubuntu)
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to libyaml in Ubuntu.
https://bugs.launchpad.net/bugs/1400736

Title:
  CVE-2014-9130 libyaml: denial-of-service/application crash with
  untrusted yaml input

Status in libyaml package in Ubuntu:
  Confirmed

Bug description:
  There is a new CVE for libyaml: https://security-tracker.debian.org/tracker/CVE-2014-9130
  And a patch is already in the repository: https://bitbucket.org/xi/libyaml/commits/2b9156756423e967cfd09a61d125d883fca6f4f2

  The code in question is present at least in version 0.1.3 to 0.1.6 so
  all lts versions are likely affected.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libyaml/+bug/1400736/+subscriptions