CVE-2016-4303: debian debian_linux Classic Buffer Overflow
Vulnerability summary
CVE-2016-4303 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 6.96% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-09-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.96%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.96% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Exploit Reference (blog.talosintel.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- iperf3< 3.1.3-1 | < 3.0.7-1+deb8u1
- debian_linuxEOL8.0
Es1 product
- iperf3≥ 3.0, < 3.0.12 | ≥ 3.1, < 3.1.3
Mageia1 product
- iperf< 3.0.12-1.mga5
Novell1 product
Suse1 product
- iperf&distro=SUSE Package Hub 12< 3.1.3-6.1
Ubuntu1 product
- iperf3< 3.0.11-1ubuntu0.1~esm1
7 vendors · 10 products
References
17 links- raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.ascX Refsource CONFIRMThird Party AdvisoryWEBREPORT
- github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412aX Refsource CONFIRMPatchThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-08/msg00082.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-08/msg00090.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2020/01/msg00023.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 17 references
- bugzilla.suse.com/984453REPORT