Source: libyaml-syck-perl Version: 1.36-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for libyaml-syck-pel. Sorry I'm filling one single bug covering multiple CVEs but in this case there was as well just one commit covering all 4 CVEs, so it is affordable to cover in one bug and not make further affected version distinctions. CVE-2026-57077[0]: | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read | via an unbounded newline scan in newline_len. In the bundled | libsyck newline_len and is_newline dereference the scan pointer, and | the following byte for a "\r\n" pair, with no NUL-terminator or | bounds check. During block-scalar lexing at a document boundary the | scan runs one byte past the heap lexer buffer. This is an incomplete | fix of CVE-2025-11683, on a lexer path the earlier fix did not | cover. Any caller that runs Load or LoadFile on an untrusted | document with a block scalar at a document boundary reaches the | over-read. CVE-2026-57076[1]: | YAML::Syck versions before 1.47 for Perl allow a heap use-after-free | via an anchor name reused as an anchors-table key in | syck_hdlr_add_anchor. In the bundled libsyck an anchor name | allocated by syck_strndup is stored both as node->anchor, freed when | the node is freed, and as the key in the parser's anchors table. | Freeing the node frees the shared key, and a later anchor | redefinition makes st_delete compare against the freed key, so | st_strcmp reads freed heap memory. Anchors are a standard YAML | feature and need no special flags, so this is reached on the default | Load path. Any caller that runs Load or LoadFile on an untrusted | document that redefines an anchor reaches the read of freed memory. CVE-2026-57075[2]: | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read | via a signed-char lookup-table index in syck_base64dec. The base64 | decoder in the bundled libsyck indexes the 256-entry static table | b64_xtable with a signed char, so any !!binary byte >= 0x80 sign- | extends to a negative index and reads before the table. The decoder | receives the raw bytes of any !!binary node, a standard YAML type | not gated by $LoadBlessed or $LoadCode, so it is reached on the | default Load path. Any caller that runs Load or LoadFile on an | untrusted document containing a !!binary scalar with a high-bit byte | triggers the read, and the value read can surface in the decoded | result. CVE-2026-13713[3]: | YAML::Syck versions before 1.47 for Perl allow a use-after-free and | double-free via an anchor node freed while still on the parser value | stack. In the bundled libsyck, when an anchor name is redefined or | removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the | node stored under that name with syck_free_node. That node can still | be live on the parser's value stack, so syck_hdlr_add_node reaches | it again and frees it a second time. On a normal build the 48-byte | node chunk is freed twice and the interpreter aborts. Anchors need | no special flags, so this is reached on the default Load path, and a | 7-byte document that redefines an anchor triggers it. Any caller | that runs Load or LoadFile on an untrusted document that redefines | an anchor mid-parse crashes the interpreter, a denial of service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-57077 https://www.cve.org/CVERecord?id=CVE-2026-57077 [1] https://security-tracker.debian.org/tracker/CVE-2026-57076 https://www.cve.org/CVERecord?id=CVE-2026-57076 [2] https://security-tracker.debian.org/tracker/CVE-2026-57075 https://www.cve.org/CVERecord?id=CVE-2026-57075 [3] https://security-tracker.debian.org/tracker/CVE-2026-13713 https://www.cve.org/CVERecord?id=CVE-2026-13713 [4] https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b Regards, Salvatore
