CVE-2013-6370
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a...
CVE-2013-6370 is a medium vulnerability (CVSS 5.0) in Json-c, published April 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.31%, the 91st percentile. Fixed in json-c 0.11-4.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 4.31%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.11-4json-c +25 more
Description
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
json-cDebian:12 | before 0.11-4 | 0.11-4 |
json-cDebian:13 | before 0.11-4 | 0.11-4 |
json-cDebian:14 | before 0.11-4 | 0.11-4 |
json-cMageia:3 From an advisory covering 2 CVEs | before 0.11-1.mga3 | 0.11-1.mga3 |
json-cMageia:4 From an advisory covering 2 CVEs | before 0.11-3.1.mga4 | 0.11-3.1.mga4 |
json-cRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-develRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-docRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-cRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
json-c-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-develRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-docRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-cRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-develRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-docRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-cRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-develRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-c-docRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:0.11-4.el7_0 | 0:0.11-4.el7_0 |
json-cUbuntu:14.04:LTS | before 0.11-3ubuntu1.2, plus listed versions 0.11-2ubuntu10.11-3ubuntu1 | 0.11-3ubuntu1.2 |
json-cUbuntu:14.04:LTS From an advisory covering 2 CVEs | before 0.11-3ubuntu1.2, plus listed versions 0.11-2ubuntu10.11-3ubuntu1 | 0.11-3ubuntu1.2 |
json-copenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 0.12.1-1.3 | 0.12.1-1.3 |
rsyslogopenSUSE:Tumbleweed From an advisory covering 6 CVEs | before 8.23.0-2.1 | 8.23.0-2.1 |
json-copenSUSE:Tumbleweed From an advisory covering 4 CVEs | before 0.19-1.1 | 0.19-1.1 |
What each source reports
NVD Score used
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
CVE-2013-6370- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
CVE-2013-6370- Updated
- 2026-11-02
EUVDEUVD-2013-6195No score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
EUVD-2013-6195- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w5g5-g39g-7p84No score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a...
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
GHSA-w5g5-g39g-7p84- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2013-6370
CVE-2013-6370 does not affect BellSoft software
- Record
BELL-CVE-2013-6370- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVNo score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
CVE-2013-6370- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2013-6370No score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
DEBIAN-CVE-2013-6370- Updated
- 2026-11-02
OSVMGASA-2014-0175No score
Updated json-c packages fix security vulnerabilities
Updated json-c packages fix security vulnerabilities:
Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using size_t if possible for sizes, or to be hardened against negative values if not. This could be used to cause a denial of service in an application linked to the json-c library (CVE-2013-6370).
Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially-crafted JSON data, to use excessive amounts of CPU (CVE-2013-6371).
- Record
MGASA-2014-0175- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10013-1No score
libjson-c-devel-0.12.1-1.3 on GA media
These are all security issues fixed in the libjson-c-devel-0.12.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10013-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10498-1No score
rsyslog-8.23.0-2.1 on GA media
These are all security issues fixed in the rsyslog-8.23.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10498-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11188-1No score
json-c-devel-0.19-1.1 on GA media
These are all security issues fixed in the json-c-devel-0.19-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11188-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6370No score
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.
- Record
UBUNTU-CVE-2013-6370- Updated
- 2026-11-02
OSVUSN-2245-1No score
json-c vulnerabilities
Florian Weimer discovered that json-c incorrectly handled buffer lengths. An attacker could use this issue with a specially-crafted large JSON document to cause json-c to crash, resulting in a denial of service. (CVE-2013-6370)
Florian Weimer discovered that json-c incorrectly handled hash arrays. An attacker could use this issue with a specially-crafted JSON document to cause json-c to consume CPU resources, resulting in a denial of service. (CVE-2013-6371)
- Record
USN-2245-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
mandriva.com/security/advisories?name=MDVSA-2014:079
bugzilla.redhat.com/show_bug.cgi?id=1032322
secunia.com/advisories/57791
exchange.xforce.ibmcloud.com/vulnerabilities/92540
lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015
Show 28 moreShow less
securityfocus.com/bid/66720
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
nvd.nist.gov/vuln/detail/CVE-2013-6370
docs.bell-sw.com/security/cves/CVE-2013-6370
security-tracker.debian.org/tracker/CVE-2013-6370
advisories.mageia.org/MGASA-2014-0175.html
bugs.mageia.org/show_bug.cgi?id=13179
access.redhat.com/errata/RHSA-2014:0703
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0703.json
cve.org/CVERecord?id=CVE-2013-6370
ubuntu.com/security/CVE-2013-6370
suse.com/security/cve/CVE-2013-6370