SB2023040712 - Multiple vulnerabilities in yasm

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2021-33459)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nasm_parser_directive() function in modules/parsers/nasm/nasm-parse.c. A remote attacker can perform a denial of service (DoS) attack.

2) NULL pointer dereference (CVE-ID: CVE-2021-33454)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the yasm_expr_get_intnum() function in libyasm/expr.c. A remote attacker can perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
• https://github.com/yasm/yasm/issues/167
• https://github.com/yasm/yasm/issues/166