[SECURITY] [DLA 2301-1] json-c security update

2020-07-3014:43:31

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

43.7%

JSON

Debian LTS Advisory DLA-2301-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
July 30, 2020 https://wiki.debian.org/LTS

Package : json-c
Version : 0.12.1-1.1+deb9u1
CVE ID : CVE-2020-12762
Debian Bug : 960326

Tobias Stoeckmann found an integer overflow issue in JSON-C, a C
library to manipulate JSON objects, when reading maliciously crafted
large files. The issue could be exploited to cause denial of service
or possibly execute arbitrary code.

For Debian 9 stretch, this problem has been fixed in version
0.12.1-1.1+deb9u1.

We recommend that you upgrade your json-c packages.

For the detailed security status of json-c please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/json-c

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10mipsellibjson-c3-udeb< 0.12.1+ds-2+deb10u1libjson-c3-udeb_0.12.1+ds-2+deb10u1_mipsel.deb
Debian9armellibjson-c3< 0.12.1-1.1+deb9u1libjson-c3_0.12.1-1.1+deb9u1_armel.deb
Debian9alljson-c< 0.12.1-1.1+deb9u1json-c_0.12.1-1.1+deb9u1_all.deb
Debian10armellibjson-c3-udeb< 0.12.1+ds-2+deb10u1libjson-c3-udeb_0.12.1+ds-2+deb10u1_armel.deb
Debian8alljson-c< 0.11-4+deb8u2json-c_0.11-4+deb8u2_all.deb
Debian9armellibjson-c-dev< 0.12.1-1.1+deb9u1libjson-c-dev_0.12.1-1.1+deb9u1_armel.deb
Debian10ppc64ellibjson-c3< 0.12.1+ds-2+deb10u1libjson-c3_0.12.1+ds-2+deb10u1_ppc64el.deb
Debian9i386libjson-c3< 0.12.1-1.1+deb9u1libjson-c3_0.12.1-1.1+deb9u1_i386.deb
Debian8i386libjson-c2-dbg< 0.11-4+deb8u2libjson-c2-dbg_0.11-4+deb8u2_i386.deb
Debian10mips64ellibjson-c3-dbgsym< 0.12.1+ds-2+deb10u1libjson-c3-dbgsym_0.12.1+ds-2+deb10u1_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	mipsel	libjson-c3-udeb	< 0.12.1+ds-2+deb10u1	libjson-c3-udeb_0.12.1+ds-2+deb10u1_mipsel.deb
Debian	9	armel	libjson-c3	< 0.12.1-1.1+deb9u1	libjson-c3_0.12.1-1.1+deb9u1_armel.deb
Debian	9	all	json-c	< 0.12.1-1.1+deb9u1	json-c_0.12.1-1.1+deb9u1_all.deb
Debian	10	armel	libjson-c3-udeb	< 0.12.1+ds-2+deb10u1	libjson-c3-udeb_0.12.1+ds-2+deb10u1_armel.deb
Debian	8	all	json-c	< 0.11-4+deb8u2	json-c_0.11-4+deb8u2_all.deb
Debian	9	armel	libjson-c-dev	< 0.12.1-1.1+deb9u1	libjson-c-dev_0.12.1-1.1+deb9u1_armel.deb
Debian	10	ppc64el	libjson-c3	< 0.12.1+ds-2+deb10u1	libjson-c3_0.12.1+ds-2+deb10u1_ppc64el.deb
Debian	9	i386	libjson-c3	< 0.12.1-1.1+deb9u1	libjson-c3_0.12.1-1.1+deb9u1_i386.deb
Debian	8	i386	libjson-c2-dbg	< 0.11-4+deb8u2	libjson-c2-dbg_0.11-4+deb8u2_i386.deb
Debian	10	mips64el	libjson-c3-dbgsym	< 0.12.1+ds-2+deb10u1	libjson-c3-dbgsym_0.12.1+ds-2+deb10u1_mips64el.deb