PT-2016-5883 · Cjson+2 · Cjson+2

Dave Mcdaniel · Published 2016-07-05 · Updated 2025-01-15 · CVE-2016-4303

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cJSON library (affected versions not specified)

Description The issue is related to the mishandling of UTF8/16 strings by the parse string function in the cJSON library. This allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, triggering a heap-based buffer overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2016-1737

CVE-2016-4303

DLA-2080-1

MGASA-2016-0235

OPENSUSE-SU-2016:2113-1

OPENSUSE-SU-2016:2121-1

OPENSUSE-SU-2024:10145-1

USN-4788-1

Affected Products

Alt Linux

Ubuntu

Cjson

References · 28

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0164 · Exploit
• 🔥 http://blog.talosintel.com/2016/06/esnet-vulnerability.html · Exploit
• https://github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412a · Patch
• https://osv.dev/vulnerability/USN-4788-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4303 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4303 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4303 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4DE6NEEUEC3XI62GE2MB2EK5BUCZ6MCP · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4788-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2080-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4303 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-4303 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00090.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2016:2113-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00082.html · Vendor Advisory