Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade jq | Aug 30, 2017 | May 6, 2016 |
| Amazon_linux | — | Upgrade jq | Jul 1, 2017 | May 6, 2016 |
| Debian | — | Upgrade jq | Jul 30, 2024 | May 6, 2016 |
| Gentoo Linux | — | Upgrade app-misc/jq. | Oct 30, 2017 | May 6, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 6, 2016 |
| Suse | — | Upgrade libjq-develUpgrade jqUpgrade libjq1 | May 4, 2016 | May 4, 2016 |
| Ubuntu | — | Upgrade jq | Nov 19, 2024 | May 6, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 6, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub