CVE-2016-4425

Summary

Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2016/05/03/3
• http://www.openwall.com/lists/oss-security/2016/05/01/5
• http://www.openwall.com/lists/oss-security/2016/05/02/1
• https://github.com/akheron/jansson/issues/282
• https://github.com/akheron/jansson/pull/284
• https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318
• http://www.debian.org/security/2015/dsa-3577

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• http://www.openwall.com/lists/oss-security/2016/05/03/3
• http://www.openwall.com/lists/oss-security/2016/05/01/5
• http://www.openwall.com/lists/oss-security/2016/05/02/1
• https://github.com/akheron/jansson/issues/282
• https://github.com/akheron/jansson/pull/284
• https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318
• http://www.debian.org/security/2015/dsa-3577

• ←Previous
• Next→