OSV-2024-831 Heap-buffer-overflow in jv_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66929 Crash type: Heap-buffer-overflow READ 4 Crash state: jvparse ftonumber jqnext...

jq:jq_fuzz_execute: Heap-buffer-overflow in jv_parse

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=4891865084133376 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzexecute Job Type: libfuzzerasanjq Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6030000113c1 Crash...

AZL-6504 CVE-2015-8863 affecting package jq for versions less than 1.5-6

Off-by-one error in the tokenadd function in jvparse.c in jq allows remote attackers to cause a denial of service crash via a long JSON-encoded number, which triggers a heap-based buffer overflow...