The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0007 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has yajl packages installed that are affected by a vulnerability:

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3492 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3492-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : yajl     Version        : 2.1.0-3+deb10u2     CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460     Debian Bug     : 1040036

    Multiple vulnerabilties have been found in yajl, a JSON parser / small     validating JSON generator# written in ANSI C, which potentially can     cause memory corruption or DoS.

    The CVE-20117-16516 had been addressed already in DLA-3478, however the     fix has been found to be incomplete as it missed an additional memory     leak.  This update fixes that problem.

    CVE-2017-16516

      When a crafted JSON file is supplied to yajl, the process might       crash with a SIGABRT in the yajl_string_decode function in       yajl_encode.c. This results potentially in a denial of service.

    CVE-2022-24795

      The 1.x branch and the 2.x branch of `yajl` contain an integer       overflow which leads to subsequent heap memory corruption when dealing       with large (~2GB) inputs.

    CVE-2023-33460

      There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse       function, which potentially cause out-of-memory in server and cause       crash.

    For Debian 10 buster, these problems have been fixed in version     2.1.0-3+deb10u2.

    We recommend that you upgrade your yajl packages.

    For the detailed security status of yajl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/yajl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-1 advisory.

    It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape     sequences. If a user or automated system using YAJL were tricked into processing specially crafted input,     an attacker could possibly use this issue to cause a denial of service (application abort).
    (CVE-2017-16516)

    It was discovered that YAJL was not properly handling memory allocation when dealing with large inputs,     which could lead to heap memory corruption. If a user or automated system using YAJL were tricked into     running a specially crafted large input, an attacker could possibly use this issue to cause a denial of     service. (CVE-2022-24795)

    It was discovered that memory leaks existed in one of the YAJL parsing functions. An attacker could     possibly use this issue to cause a denial of service (memory exhaustion). (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-279 advisory.

    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7057 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7057 advisory.

    - fix CVE-2023-33460

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3478 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3478-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     July 02, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : yajl     Version        : 2.1.0-2+deb10u1     CVE ID         : CVE-2023-33460     Debian Bug     : 1039984

    A memory leak has been found in yajl, a JSON parser / small validating     JSON generator written in ANSI C, which might allow an attacker to cause     an out of memory situation and potentially causing a crash.

    For Debian 10 buster, this problem has been fixed in version     2.1.0-2+deb10u1.

    We recommend that you upgrade your yajl packages.

    For the detailed security status of yajl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/yajl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory.

    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-2 advisory.

    USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0074 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
236459	Alibaba Cloud Linux 3 : 0007: yajl (ALINUX3-SA-2024:0007)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
242744	NewStart CGSL MAIN 7.02 : yajl Vulnerability (NS-SA-2025-0202)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
178173	Debian dla-3492 : libyajl-dev - security update	Nessus	Debian Local Security Checks	2023/7/11	2025/1/22	high
178443	Ubuntu 16.04 ESM / 18.04 ESM : YAJL vulnerabilities (USN-6233-1)	Nessus	Ubuntu Local Security Checks	2023/7/18	2024/8/27	high
179748	Amazon Linux 2023 : yajl, yajl-devel (ALAS2023-2023-279)	Nessus	Amazon Linux Local Security Checks	2023/8/14	2024/12/11	medium
185703	RHEL 8 : yajl (RHSA-2023:7057)	Nessus	Red Hat Local Security Checks	2023/11/14	2024/11/7	medium
186129	Oracle Linux 8 : yajl (ELSA-2023-7057)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	medium
177886	Debian dla-3478 : libyajl-dev - security update	Nessus	Debian Local Security Checks	2023/7/2	2025/1/22	medium
179789	Amazon Linux 2 : yajl (ALAS-2023-2182)	Nessus	Amazon Linux Local Security Checks	2023/8/14	2024/12/11	medium
186986	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : YAJL vulnerabilities (USN-6233-2)	Nessus	Ubuntu Local Security Checks	2023/12/15	2024/10/29	high
276269	TencentOS Server 4: yajl (TSSA-2025:0074)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium

检测

插件搜索

medium

medium

high

high

medium

medium

medium

medium

medium

high

medium

medium