jq 1.2e-111 decNumber/decNumber.c decToString out-of-bounds write

Summaryinfo

A vulnerability described as critical has been identified in jq 1.2e-111. Affected is the function decToString of the file decNumber/decNumber.c. Executing a manipulation with the input []-1.2e-1111111111 can lead to out-of-bounds write. This vulnerability appears as CVE-2023-49355. There is no available exploit.

Detailsinfo

A vulnerability has been found in jq 1.2e-111 and classified as critical. This vulnerability affects the function decToString of the file decNumber/decNumber.c. The manipulation with the input value []-1.2e-1111111111 leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.

The weakness was presented 12/11/2023. The advisory is available at github.com. This vulnerability was named CVE-2023-49355 since 11/27/2023. Technical details are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• jq

Version

• 1.2e-111

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion