Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Azure yasm 1.3.0 can be forced to crash remotely

published 2 years ago
Summary

The yasm package version 1.3.0 used in Azure can be made to stop working if a malicious user sends specially crafted data to a function in its code library. This results in a denial of service, meaning the service becomes unavailable. Update the yasm package to a newer version or apply the vendor's recommended patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure yasm <= 1.3.0-17
Original advisory text
CVE-2023-49557 affecting package yasm 1.3.0-17
An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Timeline
Published3 Jan 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-35394 · OSV
Track software like this
Free during beta