The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-00572178e1 advisory.

    Security fix for memory leak(s) leading to denial of service (CVE-2023-33460).
    Security fix for integer overflow leading to heap corruption (CVE-2022-24795)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-852b377773 advisory.

    Security fix for memory leak(s) leading to denial of service (CVE-2023-33460).
    Security fix for integer overflow leading to heap corruption (CVE-2022-24795)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2063 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795)

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:6551 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the yajl-2.1.0-22.el9 build changelog.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory.

    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3492 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3492-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : yajl     Version        : 2.1.0-3+deb10u2     CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460     Debian Bug     : 1040036

    Multiple vulnerabilties have been found in yajl, a JSON parser / small     validating JSON generator# written in ANSI C, which potentially can     cause memory corruption or DoS.

    The CVE-20117-16516 had been addressed already in DLA-3478, however the     fix has been found to be incomplete as it missed an additional memory     leak.  This update fixes that problem.

    CVE-2017-16516

      When a crafted JSON file is supplied to yajl, the process might       crash with a SIGABRT in the yajl_string_decode function in       yajl_encode.c. This results potentially in a denial of service.

    CVE-2022-24795

      The 1.x branch and the 2.x branch of `yajl` contain an integer       overflow which leads to subsequent heap memory corruption when dealing       with large (~2GB) inputs.

    CVE-2023-33460

      There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse       function, which potentially cause out-of-memory in server and cause       crash.

    For Debian 10 buster, these problems have been fixed in version     2.1.0-3+deb10u2.

    We recommend that you upgrade your yajl packages.

    For the detailed security status of yajl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/yajl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-1 advisory.

    It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape     sequences. If a user or automated system using YAJL were tricked into processing specially crafted input,     an attacker could possibly use this issue to cause a denial of service (application abort).
    (CVE-2017-16516)

    It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs,     which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into     running a specially crafted large input, an attacker could possibly use this issue to cause a denial of     service. (CVE-2022-24795)

    It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could     possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7057 advisory.

    - fix CVE-2023-33460

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7057 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has yajl packages installed that are affected by a vulnerability:

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0187 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-24795:
    yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL.

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0007 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
178323	Fedora 38 : yajl (2023-00572178e1)	Nessus	Fedora Local Security Checks	2023/7/16	2024/11/14	high
178918	Fedora 37 : yajl (2023-852b377773)	Nessus	Fedora Local Security Checks	2023/7/27	2024/11/14	high
193894	RHEL 8 : yajl (RHSA-2024:2063)	Nessus	Red Hat Local Security Checks	2024/4/25	2024/11/7	high
196982	Rocky Linux 9 : yajl (RLSA-2023:6551)	Nessus	Rocky Linux Local Security Checks	2024/5/14	2024/5/14	medium
191373	CentOS 9 : yajl-2.1.0-22.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
179748	Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)	Nessus	Amazon Linux Local Security Checks	2023/8/14	2024/12/11	medium
178173	Debian dla-3492 : libyajl-dev - security update	Nessus	Debian Local Security Checks	2023/7/11	2025/1/22	high
178443	Ubuntu 16.04 ESM / 18.04 ESM : YAJL vulnerabilities (USN-6233-1)	Nessus	Ubuntu Local Security Checks	2023/7/18	2024/8/27	high
186129	Oracle Linux 8 : yajl (ELSA-2023-7057)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	medium
185703	RHEL 8 : yajl (RHSA-2023:7057)	Nessus	Red Hat Local Security Checks	2023/11/14	2024/11/7	medium
242744	NewStart CGSL MAIN 7.02 : yajl Vulnerability (NS-SA-2025-0202)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
235971	Alibaba Cloud Linux 3 : 0187: yajl (ALINUX3-SA-2024:0187)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
236459	Alibaba Cloud Linux 3 : 0007: yajl (ALINUX3-SA-2024:0007)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium

偵測

搜尋 Plugin

high

high

high

medium

medium

medium

high

high

medium

medium

medium

high

medium