update: libyaml

[dongsupark]

Name: libyaml
CVEs: CVE-2024-35325, CVE-2024-35326
CVSSs: n/a, 9.8
Action Needed: TBD

Summary:

• CVE-2024-35325: A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2292350
• CVE-2024-35326: libyaml v0.2.5 is vulnerable to Buffer Overflow. Affected by this issue is the function yaml_emitter_emit of the file /src/libyaml/src/emitter.c. The manipulation leads to a double-free.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2292351

refmap.gentoo: TBD

[dongsupark]

CVE-2024-35326 has now critical severity.
However, upstream libyaml maintainer seems to think it is not a valid issue, including other similar ones.

[dongsupark]

Both CVEs were withdrawn, closing.