Your message dated Fri, 17 Jul 2026 13:20:21 +0000
with message-id <[email protected]>
and subject line Bug#1142267: fixed in libyaml-syck-perl 1.47-1
has caused the Debian Bug report #1142267,
regarding libyaml-syck-perl: CVE-2026-57077 CVE-2026-57076 CVE-2026-57075
CVE-2026-13713
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142267: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142267
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libyaml-syck-perl
Version: 1.36-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libyaml-syck-pel.
Sorry I'm filling one single bug covering multiple CVEs but in this
case there was as well just one commit covering all 4 CVEs, so it is
affordable to cover in one bug and not make further affected version
distinctions.
CVE-2026-57077[0]:
| YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read
| via an unbounded newline scan in newline_len. In the bundled
| libsyck newline_len and is_newline dereference the scan pointer, and
| the following byte for a "\r\n" pair, with no NUL-terminator or
| bounds check. During block-scalar lexing at a document boundary the
| scan runs one byte past the heap lexer buffer. This is an incomplete
| fix of CVE-2025-11683, on a lexer path the earlier fix did not
| cover. Any caller that runs Load or LoadFile on an untrusted
| document with a block scalar at a document boundary reaches the
| over-read.
CVE-2026-57076[1]:
| YAML::Syck versions before 1.47 for Perl allow a heap use-after-free
| via an anchor name reused as an anchors-table key in
| syck_hdlr_add_anchor. In the bundled libsyck an anchor name
| allocated by syck_strndup is stored both as node->anchor, freed when
| the node is freed, and as the key in the parser's anchors table.
| Freeing the node frees the shared key, and a later anchor
| redefinition makes st_delete compare against the freed key, so
| st_strcmp reads freed heap memory. Anchors are a standard YAML
| feature and need no special flags, so this is reached on the default
| Load path. Any caller that runs Load or LoadFile on an untrusted
| document that redefines an anchor reaches the read of freed memory.
CVE-2026-57075[2]:
| YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read
| via a signed-char lookup-table index in syck_base64dec. The base64
| decoder in the bundled libsyck indexes the 256-entry static table
| b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-
| extends to a negative index and reads before the table. The decoder
| receives the raw bytes of any !!binary node, a standard YAML type
| not gated by $LoadBlessed or $LoadCode, so it is reached on the
| default Load path. Any caller that runs Load or LoadFile on an
| untrusted document containing a !!binary scalar with a high-bit byte
| triggers the read, and the value read can surface in the decoded
| result.
CVE-2026-13713[3]:
| YAML::Syck versions before 1.47 for Perl allow a use-after-free and
| double-free via an anchor node freed while still on the parser value
| stack. In the bundled libsyck, when an anchor name is redefined or
| removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the
| node stored under that name with syck_free_node. That node can still
| be live on the parser's value stack, so syck_hdlr_add_node reaches
| it again and frees it a second time. On a normal build the 48-byte
| node chunk is freed twice and the interpreter aborts. Anchors need
| no special flags, so this is reached on the default Load path, and a
| 7-byte document that redefines an anchor triggers it. Any caller
| that runs Load or LoadFile on an untrusted document that redefines
| an anchor mid-parse crashes the interpreter, a denial of service.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-57077
https://www.cve.org/CVERecord?id=CVE-2026-57077
[1] https://security-tracker.debian.org/tracker/CVE-2026-57076
https://www.cve.org/CVERecord?id=CVE-2026-57076
[2] https://security-tracker.debian.org/tracker/CVE-2026-57075
https://www.cve.org/CVERecord?id=CVE-2026-57075
[3] https://security-tracker.debian.org/tracker/CVE-2026-13713
https://www.cve.org/CVERecord?id=CVE-2026-13713
[4]
https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libyaml-syck-perl
Source-Version: 1.47-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libyaml-syck-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libyaml-syck-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 17 Jul 2026 14:57:10 +0200
Source: libyaml-syck-perl
Architecture: source
Version: 1.47-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1142267
Changes:
libyaml-syck-perl (1.47-1) unstable; urgency=medium
.
* Import upstream version 1.47.
- Fix four libsyck memory-safety CVEs reachable from the default
YAML::Syck::Load() path on untrusted input with no special flags:
CVE-2026-57077 CVE-2026-57076 CVE-2026-57075 CVE-2026-13713
(Closes: #1142267)
* Drop gcc15-fix.patch, fixed in 1.37 release.
* Drop fix-address-all-4-C-layer-audit-findings-from-issue-.patch.
Taken from upstream Git, fixed in 1.37.
* Drop fix-prevent-buffer-underflow-in-base60-sexagesimal-p.patch.
Taken from upstream Git, fixed in 1.45.
* Declare compliance with Debian Policy 4.7.4.
* Add debian/tests/pkg-perl/smoke-tests.
Only run t/*.t during autopkgtests, as during build.
Checksums-Sha1:
a0552c550ac2ddfd0f8c9766b0c29b961c2c3aa8 2414 libyaml-syck-perl_1.47-1.dsc
7c421304c7b213127862c667a3f438c06fd712a8 270328
libyaml-syck-perl_1.47.orig.tar.gz
db399c620a6936b260fd21395bd73f0c8f5619bd 7376
libyaml-syck-perl_1.47-1.debian.tar.xz
Checksums-Sha256:
cbf09b3fe6f9ab20436677ccb255231695ef38bea81be04187f426368cef0c53 2414
libyaml-syck-perl_1.47-1.dsc
672196ca1c021e3c68f4b5f7b4aec305ad471bbbf448c53c7e40034d6ebb7e1d 270328
libyaml-syck-perl_1.47.orig.tar.gz
dd47e6d2895009db7dad157154801602db32cb5814e07825ec9eb3b50f9c46f4 7376
libyaml-syck-perl_1.47-1.debian.tar.xz
Files:
02b160cb2c4a239e686d1329e1272884 2414 perl optional
libyaml-syck-perl_1.47-1.dsc
c9202ef678821a1e723defed86353faf 270328 perl optional
libyaml-syck-perl_1.47.orig.tar.gz
edb3524a9b347cd683e0c7ac51a8328c 7376 perl optional
libyaml-syck-perl_1.47-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmpaJ39fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgbIUhAArjCtyT/GXQXx7jh1DrN7In/Oje1CagSS5KfcFt8ks9guSMIO9EhxKXg0
B38PNC5Xu3tiqe9hu3+2KynhehcwiWM+R5iKc6J5W4i5HmOEd7BoxDPO6vgv5Eof
oWzpSft498C0sKZ0lWYQGFgfmxCaiTvv/ddNbiNOGhzSg9d8cUMIILyVHry4dcb+
oqkvRjufAUWLBpYPm9XZzV8yi7JHywUoUCl+c7APbEnwCuJcTncHGTWKzoEOauC8
UeTcV0kymTL6y/hqjHxJNY9nWdizuxn9mnz4A7AnsP8bkN7izizCTiwWp152410k
1ExxlSoHJIiiG/ibD3AwSiUB2SPVV01mXEpAh7hJQP7UEUTQmm/+i1034HMShk7B
WfpMufJ5IqeozmD2cOBFuhdc/rO8iCqQaQ9cVaphZYiRstGwl6A4iUZX1otVfqD7
NWB59MaHwQeihO/7g4aOylhmYDMMmFETru9iUtEMT2EQU5Wu5WlldmhDvezsQX+a
Plwjj2ZM+gMd8Kra52eFn2uQX2PFTAdpcVDHDeBiVYCh9bvXziF/+R3rbYSM8+hc
4agoud+4oUush52qTgLGcTMGT+tjXFJwyd1FauKxuCVbOnapJbu4Q7tYOPo6omDf
i3bGJ4ZG2WEeAmX5/Fcd3P5DbQy6p165jIweXZkadPnjYX/HC3I=
=YhBM
-----END PGP SIGNATURE-----
pgpQuMFrTPZ5t.pgp
Description: PGP signature
--- End Message ---
