Описание
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| jq | fixed | 1.5+dfsg-1.1 | package | |
| jq | fixed | 1.4-2.1+deb8u1 | jessie | package |
Примечания
https://github.com/stedolan/jq/issues/995
https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd
https://www.openwall.com/lists/oss-security/2016/04/23/1
EPSS
Связанные уязвимости
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
EPSS