Source: yajl
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

After preparing the LTS upload of yajl I've seen the following issues in
the upstream github issue tracker:

CVE-2017-16516 [1] portential buffer overread: A JSON file can cause denial of
 service.

CVE-2022-24795 [2] potential integer overflow which can lead to subsequent heap
  memory corruption when dealing with large (~2GB) input

The upstream issue tracker also indicates that there might be other vulnerabilies
(without CVEs or unknown CVEs), but I did not investiage further:
https://github.com/lloyd/yajl/issues/206 (double free)
https://github.com/lloyd/yajl/issues/204 (Uninitialized memory reads and out-of-bound)

It seems that the code is unmaintained upstream. It might be a good idea to evaluate
if any of the forks are more active and whether Debian should move there.

Cheers,