PT-2020-6199 · Json-C+10 · Json-C+10
Tobias Stoeckmann
·
Published
2020-05-02
·
Updated
2025-11-03
·
CVE-2020-12762
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
json-c versions 0.14 and earlier
Description
The issue is related to an integer overflow and out-of-bounds write in json-c, which can be triggered by a large JSON file. This can be demonstrated by the
printbuf memappend function. The exploitation of this issue allows a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.Recommendations
For json-c versions 0.14 and earlier, consider updating to a version that fixes the integer overflow and out-of-bounds write issue. As a temporary workaround, consider restricting the size of JSON files that can be processed to prevent exploitation. Additionally, restrict access to sensitive data and implement measures to prevent denial of service attacks until a patch is available.
Exploit
Fix
Memory Corruption
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Json-C