json-c -- integer overflow and out-of-bounds write via a large JSON file

Tobias Stöckmann reports: I have discovered a way to trigger an out of boundary write while parsing a huge json file through a malicious input source. It can be triggered if an attacker has control over the input stream or if a huge load during filesystem operations can be triggered...

Security Bulletin: IBM® DB2® LUW is affected by the JSON-C vulnerability (CVE-2013-6371)

Summary IBM® DB2® LUW is affected by a denial of service vulnerability in JavaScript Object Notation JSON-C, caused by an error in the hash function during string parsing. A remote, unauthorized user could exploit this vulnerability to consume all available CPU resources. Vulnerability Details CV...

Fedora 27 : json-c (2017-20b18a4ffe)

Patch : - Avoid invalid free and crash explicitly instead of silently enabling the caller to commit undefined behaviour. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Fedora 26 : json-c (2017-6d952bdc53)

Patch : - Avoid invalid free and crash explicitly instead of silently enabling the caller to commit undefined behaviour. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Fedora Update for json-c FEDORA-2017-20b18a4ffe

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for json-c FEDORA-2017-6d952bdc53

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: json-c-0.12.1-5.fc27

JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON formatted strings and parse JSON formatted strings back into the C representation of JSON objects. It aims to conform to RFC 7159...

[SECURITY] Fedora 26 Update: json-c-0.12.1-5.fc26

JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON formatted strings and parse JSON formatted strings back into the C representation of JSON objects. It aims to conform to RFC 7159...

IPv6 Address Spoofing: sylkie

IPv6 Address Spoofing A command line tool and library for testing networks for common address spoofing security vulnerabilities in IPv6 networks using the Neighbor Discovery Protocol. Getting Started Dependencies libseccomp json-c Build Get the code and compile it! Get the code git clone...

Oracle: Security Advisory (ELSA-2014-0703)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-416)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : postgis-2.1.7-1.fc22 (2015-5510)

Update to latest release, which includes security fixes. Update to 2.1.6, per changes described at: http://postgis.net/2015/03/20/postgis-2.1.6 enable json-c for postigs, but disable it for upgrade part Rebuild for Proj 4.9.1 Note that Tenable Network Security has extracted the preceding...

Mandriva Linux Security Advisory : json-c (MDVSA-2015:102)

Updated json-c packages fix security vulnerabilities : Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using sizet if possible for sizes, or to be...

Amazon Linux AMI : json-c (ALAS-2014-416)

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service CPU consumption via crafted JSON data, involving collisions. Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified...

Medium: json-c

Issue Overview: The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service CPU consumption via crafted JSON data, involving collisions. Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service...

IBM DB2 10.5 < Fix Pack 4 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 10.5 running on the remote host is affected by the following vulnerabilities : - An error exists related to JavaScript Object Notation JSON-C handling, string parsing, and the hash function that allows denial of service attacks. CVE-2013-6371 ...

RHEL 7 : json-c (RHSA-2014:0703)

Updated json-c packages that fix two security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Oracle Linux 7 : json-c (ELSA-2014-0703)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0703 advisory. - fix has collision CVE-2013-6371 - fix buffer overflow CVE-2013-6370 Tenable has extracted the preceding description block directly from the Oracle...

json-c security update

0.11-4 - fix has collision CVE-2013-6371 - fix buffer overflow CVE-2013-6370 - enable upstream test suite...

RedHat Update for json-c RHSA-2014:0703-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...