CVE-2016-4074

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

A heap-based buffer overflow flaw was found in jq's tokenadd() function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system (CVE-2015-8863).

Stack exhaustion could affect availability when parsing untrusted input (CVE-2016-4074).

This update for jq fixes the following minor security issue:

• CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput (bsc#1014176)

The following tracked packaging changes are included:

• Update tests dependencies to increase test coverage (bsc#1017157)

This update was imported from the SUSE:SLE-12:Update update project.

This update for jq fixes the following minor security issue:

• CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput (bsc#1014176)

The following tracked packaging changes are included:

• Update tests dependencies to increase test coverage (bsc#1017157)

This update was imported from the SUSE:SLE-12:Update update project.

These are all security issues fixed in the jq-1.6-2.9 package on the GA media of openSUSE Tumbleweed.

This update for jq fixes the following issues:

Security issues fixed:

• CVE-2016-4074: The jv_dump_term function in jq allowed remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. (bsc#1014176)

Non-security issues fixed:

• Update tests dependencies to increase test coverage. (bsc#1017157)
• Do not run tests in qemu builds, valgrind does not work reliably in such conditions.

It was discovered that jq did not perform sufficient bounds checking, resulting in unbounded resource consumption. An attacker could use this vulnerability to cause a denial of service.