CVE-2023-50246: Heap-based Buffer Overflow

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue...

jq:jq_fuzz_fixed: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4785110121316352 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000060281 Crash State: NULL Sanitizer: undefined UBSAN Recommended Security...

SUSE CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

DEBIAN-CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

Out-of-bounds

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

UBUNTU-CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

jq buffer error vulnerability

jq is jqlang open source a lightweight and flexible command-line JSON processor . A buffer error vulnerability exists in jq v1.7-37 88f01a7 that originates from allowing an attacker to cause a denial of service via the decToString function in decNumber.c. The vulnerability is caused by a bug in j...

CVE-2023-49355

The CVE-2023-49355 entry concerns jq (commit 88f01a7) with a vulnerability in decToString in decNumber/decNumber.c where a one-byte out-of-bounds write occurs from input like []-1.2e-1111111111. This is tied to the decNumber path and affects the jq code path processing numeric literals. The provi...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355: Out-of-bounds Write

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

CVE-2023-49355

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " -1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation...

jq:jq_fuzz_fixed: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=4804164877942784 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State:...

PT-2023-31180 · Jq · Jq

Name of the Vulnerable Software and Affected Versions: jq version 88f01a7 Description: The issue is related to a one-byte out-of-bounds write in the decToString function in decNumber/decNumber.c. This occurs when the input " -1.2e-1111111111" is processed. Recommendations: For jq version 88f01a7,...

jq:jq_fuzz_execute: Stack-buffer-overflow in decNaNs

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=6049451026022400 Project: jq Fuzzing Engine: afl Fuzz Target: jqfuzzexecute Job Type: aflasanjq Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 2 Crash Address: 0x7ffff41e6a8c Crash State:...