diff -Nru libyaml-0.1.4/debian/changelog libyaml-0.1.4/debian/changelog --- libyaml-0.1.4/debian/changelog 2014-04-02 15:44:25.000000000 +0000 +++ libyaml-0.1.4/debian/changelog 2015-01-09 02:17:34.000000000 +0000 @@ -1,3 +1,11 @@ +libyaml (0.1.4-2ubuntu0.12.04.4) precise-security; urgency=medium + + * SECURITY UPDATE: denial of service via triggered assertion + - debian/patches/CVE-2014-9130.patch: remove assertion + - CVE-2014-9130 + + -- Steve Beattie Thu, 08 Jan 2015 18:17:27 -0800 + libyaml (0.1.4-2ubuntu0.12.04.3) precise-security; urgency=medium * SECURITY UPDATE: denial of service and possible code execution via diff -Nru libyaml-0.1.4/debian/patches/CVE-2014-9130.patch libyaml-0.1.4/debian/patches/CVE-2014-9130.patch --- libyaml-0.1.4/debian/patches/CVE-2014-9130.patch 1970-01-01 00:00:00.000000000 +0000 +++ libyaml-0.1.4/debian/patches/CVE-2014-9130.patch 2015-01-09 02:17:17.000000000 +0000 @@ -0,0 +1,32 @@ +From: Kirill Simonov +Subject: Removed invalid simple key assertion (thank to Jonathan Gray). +Origin: upstream, https://bitbucket.org/xi/libyaml/commits/2b9156756423e967cfd09a61d125d883fca6f4f2 +Bug: https://bitbucket.org/xi/libyaml/issue/10 +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771366 +Last-Update: 2014-11-28 + +--- + src/scanner.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/src/scanner.c b/src/scanner.c +index 88d4fa5..5ec0be0 100644 +--- a/src/scanner.c ++++ b/src/scanner.c +@@ -1106,13 +1106,6 @@ yaml_parser_save_simple_key(yaml_parser_t *parser) + && parser->indent == (ptrdiff_t)parser->mark.column); + + /* +- * A simple key is required only when it is the first token in the current +- * line. Therefore it is always allowed. But we add a check anyway. +- */ +- +- assert(parser->simple_key_allowed || !required); /* Impossible. */ +- +- /* + * If the current position may start a simple key, save it. + */ + +-- +2.2.0 + diff -Nru libyaml-0.1.4/debian/patches/series libyaml-0.1.4/debian/patches/series --- libyaml-0.1.4/debian/patches/series 2014-04-02 15:44:20.000000000 +0000 +++ libyaml-0.1.4/debian/patches/series 2015-01-09 02:17:17.000000000 +0000 @@ -1,2 +1,3 @@ CVE-2013-6393.patch CVE-2014-2525.patch +CVE-2014-9130.patch