MGASA-2014-0175: json-c Mageia
Vulnerability summary
MGASA-2014-0175 is a vulnerability in json-c Mageia with no CVSS score yet.
Advisory lineage
Upstream 2 · Downstream 0Timeline
- 16-04-2014PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated json-c packages fix security vulnerabilities Updated json-c packages fix security vulnerabilities: Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using size_t if possible for sizes, or to be hardened against negative values if not. This could be used to cause a denial of service in an application linked to the json-c library (CVE-2013-6370). Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially-crafted JSON data, to use excessive amounts of CPU (CVE-2013-6371).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia2 products
- json-c< 0.11-1.mga3
- json-c< 0.11-3.1.mga4
1 vendor · 2 products