Please bump libyaml to 0.1.6 due to CVE-2014-2525

[mspanc]

Please bump libyaml to 0.1.6 due to CVE-2014-2525.

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

Except many other possible attack vectors, libyaml is a rather standard dependency for Ruby on Rails apps (the framework rely on YAML). Shipping insecure library can obviously lead to many unwanted problems.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: libyaml-0-2 0.1.4-3ubuntu2
ProcVersionSignature: Ubuntu 3.13.0-16.36-generic 3.13.5
Uname: Linux 3.13.0-16-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.13.3-0ubuntu1
Architecture: amd64
CurrentDesktop: GNOME
Date: Thu Apr 10 16:39:39 2014
Dependencies:
 gcc-4.9-base 4.9-20140303-0ubuntu3
 libc6 2.19-0ubuntu2
 libgcc1 1:4.9-20140303-0ubuntu3
 multiarch-support 2.19-0ubuntu2
InstallationDate: Installed on 2014-03-08 (32 days ago)
InstallationMedia: Ubuntu-GNOME 14.04 "Trusty Tahr" - Alpha amd64 (20140226)
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=pl_PL.UTF-8
 SHELL=/bin/bash
SourcePackage: libyaml
UpgradeStatus: No upgrade log present (probably fresh install)

[Marc Deslauriers (mdeslaur)]

CVE-2014-2525 was already fixed in 0.1.4-3ubuntu3:

https://launchpad.net/ubuntu/trusty/+source/libyaml/0.1.4-3ubuntu3