721 matches found
CVE-2023-49355
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
Out-of-bounds
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
UBUNTU-CVE-2023-49355
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
jq buffer error vulnerability
jq is jqlang open source a lightweight and flexible command-line JSON processor . A buffer error vulnerability exists in jq v1.7-37 88f01a7 that originates from allowing an attacker to cause a denial of service via the decToString function in decNumber.c. The vulnerability is caused by a bug in j...
CVE-2023-49355
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
CVE-2023-49355
The CVE-2023-49355 entry concerns jq (commit 88f01a7) with a vulnerability in decToString in decNumber/decNumber.c where a one-byte out-of-bounds write occurs from input like []-1.2e-1111111111. This is tied to the decNumber path and affects the jq code path processing numeric literals. The provi...
CVE-2023-49355
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
CVE-2023-49355
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...
PT-2023-31180 · Jq · Jq
Name of the Vulnerable Software and Affected Versions: jq version 88f01a7 Description: The issue is related to a one-byte out-of-bounds write in the decToString function in decNumber/decNumber.c. This occurs when the input " -1.2e-1111111111" is processed. Recommendations: For jq version 88f01a7,...
Ubuntu 16.04 ESM : jq vulnerability (USN-4787-1)
The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4787-1 advisory. It was discovered that jq did not perform sufficient bounds checking, resulting in unbounded resource consumption. An attacker could use this vulnerability to cau...
Exploit for Improper Authentication in Redhat Keycloak
PoC for CVE-2023-0264 Keycloak vulnerability that allows ses...
SUSE CVE-2015-8863
Off-by-one error in the tokenadd function in jvparse.c in jq allows remote attackers to cause a denial of service crash via a long JSON-encoded number, which triggers a heap-based buffer overflow...
SUSE CVE-2016-4074
The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...
Ubuntu: Security Advisory (USN-4787-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-26642 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided input. Description: The input describes a method to automate the process of checking for publicly available Proof of Concepts POCs for specific CVEs using command-line tools. It...
Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite
Explotación Activa Sobre Zimbra CVE-2022-37042 RCE Unauthent...
MAL-2022-2367 Malicious code in dc-test-jq (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfd0f813c9a00e7fa7804deeffffa87ae75cfebcc7a9135b5d2bdc51ff38a473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in dc-test-jq (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfd0f813c9a00e7fa7804deeffffa87ae75cfebcc7a9135b5d2bdc51ff38a473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
