CVE-2019-1010239: davegamble cjson NULL Pointer Dereference
Vulnerability summary
CVE-2019-1010239 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in davegamble cjson. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.42%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCjson
Maturity: poc
Weaknesses
CWE · root cause- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Davegamble1 product
- cjson1.7.8
Davegamble/cjson1 product
- cjson1.7.8 [fixed: 1.7.9 and later]
Debian1 product
- cjson< 1.7.10-1
Oracle1 product
- timesten_in-memory_database< 18.1.3.1.0
4 vendors · 4 products
References
4 links- github.com/DaveGamble/cJSON/commit/be749d7efa7c9021da746e685bd6dec79f9dd99bX Refsource MISCPatchThird Party Advisory
