Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 5 products
cJSON parse_hex4 over-reads on a truncated \u escape. That's CVE-2016-4303. FerroProve lifts it to a crate with #![forbid(unsafe_code)]. Valid hex is byte-identical. The over-read returns -100. rustc -D warnings passes. https://ferroprove.vercel.app
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 8.0 | - | - |
| App | es | iperf3 | - | - | - |
| App | novell | suse_package_hub_for_suse_linux_enterprise | 12 | - | - |
| OS | opensuse | leap | 42.1 | - | - |
| OS | opensuse | opensuse | 13.2 | - | - |