{"id":"USN-8925-1","summary":"libyaml-perl vulnerabilities","details":"Dominique Dumont discovered that YAML-LibYAML did not correctly handle\ncertain reflection operations. If a user or system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue\nto delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2017-20285)\n\nIt was discovered that YAML-LibYAML did not correctly handle parsing\ncertain documents. If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-25777)\n\nIt was discovered that YAML-LibYAML contained a regular expression\nsusceptible to catastrophic backtracking. If a user or automated system\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. (CVE-2026-63676)","modified":"2026-10-14T11:57:58.298079668Z","published":"2026-10-14T03:31:33Z","related":["UBUNTU-CVE-2017-20285","UBUNTU-CVE-2019-25777","UBUNTU-CVE-2026-63676"],"upstream":["CVE-2017-20285","CVE-2019-25777","CVE-2026-63676","UBUNTU-CVE-2017-20285","UBUNTU-CVE-2019-25777","UBUNTU-CVE-2026-63676"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8925-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-20285"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-25777"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63676"}],"affected":[{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu0.1~esm1"}]}],"versions":["1.13-1","1.15-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libyaml-perl","binary_version":"1.15-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2017-20285"},{"id":"CVE-2019-25777","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-63676","severity":[{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.21-1","1.24-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.24-1ubuntu0.1~esm1","binary_name":"libyaml-perl"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2017-20285"},{"id":"CVE-2019-25777","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-63676"}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.29-1","1.30-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.30-1ubuntu0.20.04.1~esm1","binary_name":"libyaml-perl"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-63676"}],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.22.04.1"}]}],"versions":["1.30-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libyaml-perl","binary_version":"1.30-1ubuntu0.22.04.1"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2026-63676","severity":[{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.24.04.1"}]}],"versions":["1.30-2","1.31-1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"1.31-1ubuntu0.24.04.1","binary_name":"libyaml-perl"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2026-63676","severity":[{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}},{"package":{"name":"libyaml-perl","ecosystem":"Ubuntu:Pro:26.04:LTS","purl":"pkg:deb/ubuntu/libyaml-perl?arch=source&distro=esm-apps%2Fresolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.31-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libyaml-perl","binary_version":"1.31-1ubuntu0.26.04.1~esm1"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2026-63676","severity":[{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:26.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8925-1.json"}}],"schema_version":"1.9.0"}