oss-security - CVE Request: jq: heap buffer overflow in tokenadd() function

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 23 Apr 2016 08:27:15 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE Request: jq: heap buffer overflow in tokenadd() function

Hi

Could you assign a CVE for the following issue in jq, a lightweight
and flexible command-line JSON processor.

Upstream report:

https://github.com/stedolan/jq/issues/995

Upstream commit:

https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd

Reports:

https://bugs.debian.org/802231
https://bugzilla.redhat.com/show_bug.cgi?id=1328747

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.