Lucene search

DebianDEBIAN:DLA-3572-1:1B84E

HistorySep 19, 2023 - 7:37 p.m.

[SECURITY] [DLA 3572-1] libyang security update

2023-09-1919:37:20

lists.debian.org

security tracker

cve-2019-20391

libyang

ietf yang

buster

parser toolkit

debian 10

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.008

Percentile

82.0%

JSON

Debian LTS Advisory DLA-3572-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
September 19, 2023 https://wiki.debian.org/LTS

Package : libyang
Version : 0.16.105+really1.0-0+deb10u1
CVE ID : CVE-2019-20391 CVE-2019-20392 CVE-2019-20393 CVE-2019-20394
CVE-2019-20395 CVE-2019-20396 CVE-2019-20397 CVE-2019-20398

Multiple flaws were found in libyang, a parser toolkit for IETF YANG data
modeling. Double frees, invalid memory access and Null pointer dereferences
may cause a denial of service or potentially code execution.

For Debian 10 buster, these problems have been fixed in version
0.16.105+really1.0-0+deb10u1.

We recommend that you upgrade your libyang packages.

For the detailed security status of libyang please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libyang

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian10arm64libyang-dev< 0.16.105+really1.0-0+deb10u1libyang-dev_0.16.105+really1.0-0+deb10u1_arm64.deb
Debian10armhflibyang0.16-dbgsym< 0.16.105+really1.0-0+deb10u1libyang0.16-dbgsym_0.16.105+really1.0-0+deb10u1_armhf.deb
Debian10i386yang-tools-dbgsym< 0.16.105+really1.0-0+deb10u1yang-tools-dbgsym_0.16.105+really1.0-0+deb10u1_i386.deb
Debian10amd64libyang0.16< 0.16.105+really1.0-0+deb10u1libyang0.16_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian10amd64libyang-cpp-dev< 0.16.105+really1.0-0+deb10u1libyang-cpp-dev_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian10amd64libyang-cpp0.16-dbgsym< 0.16.105+really1.0-0+deb10u1libyang-cpp0.16-dbgsym_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian10armhflibyang-cpp0.16< 0.16.105+really1.0-0+deb10u1libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_armhf.deb
Debian10i386yang-tools< 0.16.105+really1.0-0+deb10u1yang-tools_0.16.105+really1.0-0+deb10u1_i386.deb
Debian10arm64libyang-cpp0.16< 0.16.105+really1.0-0+deb10u1libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_arm64.deb
Debian10arm64libyang0.16-dbgsym< 0.16.105+really1.0-0+deb10u1libyang0.16-dbgsym_0.16.105+really1.0-0+deb10u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	arm64	libyang-dev	< 0.16.105+really1.0-0+deb10u1	libyang-dev_0.16.105+really1.0-0+deb10u1_arm64.deb
Debian	10	armhf	libyang0.16-dbgsym	< 0.16.105+really1.0-0+deb10u1	libyang0.16-dbgsym_0.16.105+really1.0-0+deb10u1_armhf.deb
Debian	10	i386	yang-tools-dbgsym	< 0.16.105+really1.0-0+deb10u1	yang-tools-dbgsym_0.16.105+really1.0-0+deb10u1_i386.deb
Debian	10	amd64	libyang0.16	< 0.16.105+really1.0-0+deb10u1	libyang0.16_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian	10	amd64	libyang-cpp-dev	< 0.16.105+really1.0-0+deb10u1	libyang-cpp-dev_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian	10	amd64	libyang-cpp0.16-dbgsym	< 0.16.105+really1.0-0+deb10u1	libyang-cpp0.16-dbgsym_0.16.105+really1.0-0+deb10u1_amd64.deb
Debian	10	armhf	libyang-cpp0.16	< 0.16.105+really1.0-0+deb10u1	libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_armhf.deb
Debian	10	i386	yang-tools	< 0.16.105+really1.0-0+deb10u1	yang-tools_0.16.105+really1.0-0+deb10u1_i386.deb
Debian	10	arm64	libyang-cpp0.16	< 0.16.105+really1.0-0+deb10u1	libyang-cpp0.16_0.16.105+really1.0-0+deb10u1_arm64.deb
Debian	10	arm64	libyang0.16-dbgsym	< 0.16.105+really1.0-0+deb10u1	libyang0.16-dbgsym_0.16.105+really1.0-0+deb10u1_arm64.deb