[Secure-testing-team] Bug#737076: libyaml: CVE-2013-6393: heap-based buffer overflow when parsing YAML tags

[Salvatore Bonaccorso]

Source: libyaml
Version: 0.1.3-1
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for libyaml.

CVE-2013-6393[0]:
heap-based buffer overflow when parsing YAML tags

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

See [2] in particular for the needed patch.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6393
    http://security-tracker.debian.org/tracker/CVE-2013-6393
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1033990
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1033990#c15

Note: packages for oldstable and stable are currently beeing prepared.

Regards,
Salvatore