CVE-2020-12762

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

libfastjson is a fork from json-c, and is currently under development. The aim of this is not to provide a slightly modified clone of json-c. It's aim is to provide: a small library with essential json handling functions, sufficiently good json support (not 100% standards compliant), be very fast in processing.

Security Fix(es):

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.(CVE-2020-12762)

JSON-C implements a reference counting object model that allows users to easily construct JavaScript Object Notation (JSON) objects in C, output them as JSON formatted strings, and parse JSON formatted strings back into the C representation of JSON objects.

Security Fix(es):

• json-c: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects.

Security Fix(es):

• json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section.

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects.

Security Fix(es):

• json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

JSON-C implements a reference counting object model that allows users to easily construct JavaScript Object Notation (JSON) objects in C, output them as JSON formatted strings, and parse JSON formatted strings back into the C representation of JSON objects.

Security Fix(es):

• json-c: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects.

Security Fix(es):

• json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects.

Security Fix(es):

• json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2020-12762: fix out of bounds write vulnerability in printbuf

• CVE-2020-12762: fix out of bounds write vulnerability in printbuf

• SECURITY UPDATE: integer overflow and out-of-bounds write in printbuf
  • debian/patches/CVE-2020-12762.patch: reject sizes that overflow int in printbuf_extend(), printbuf_memappend() and printbuf_memset() (printbuf.c)
  • CVE-2020-12762

Updated json-c package fixes security vulnerabilities:

It was discovered that json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend (CVE-2020-12762).

Integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. (CVE-2020-12762)

This update for json-c fixes the following issues:

• CVE-2020-12762: Fixed integer overflow and out-of-bounds write. (bsc#1171479)

These are all security issues fixed in the libfastjson-devel-1.2304.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for json-c fixes the following issues:

• CVE-2020-12762: Fixed integer overflow and out-of-bounds write. (bsc#1171479)

This update for json-c fixes the following issues:

• CVE-2020-12762: Fixed integer overflow and out-of-bounds write. (bsc#1171479)

This update for json-c fixes the following issues:

• CVE-2020-12762: Fixed an integer overflow that could lead to memory corruption via a large JSON file (bsc#1171479).

Non-security fixes:

• Updated to version 0.12.1 (jsc#PED-1778).

This update for libfastjson fixes the following issues:

• CVE-2020-12762: Fixed an integer overflow and out-of-bounds write via a large JSON file (bsc#1171479).

This update for libfastjson fixes the following issues:

• CVE-2020-12762: Fixed integer overflow and out-of-bounds write via a large JSON file (bsc#1171479).

This update for libfastjson fixes the following issues:

• CVE-2020-12762: Fixed integer overflow and out-of-bounds write via a large JSON file (bsc#1171479).

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code.

USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a memory leak that was reverted in USN-4360-2 and USN-4360-3. This update provides the correct fix update for CVE-2020-12762.

Original advisory details:

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code.