{"id":"CVE-2016-4303","aliases":["DEBIAN-CVE-2016-4303","DLA-2080-1","EUVD-2016-5303","GHSA-86rq-gv28-jjr6","MGASA-2016-0235","UBUNTU-CVE-2016-4303","USN-4788-1","openSUSE-SU-2016:2113-1","openSUSE-SU-2016:2121-1","openSUSE-SU-2024:10145-1"],"status":"published","title":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which...","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06963,"percentile":0.94168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-120"],"published":"2016-07-05T15:47:08Z","modified":"2026-10-20T13:15:40Z","fixes":[{"ecosystem":"Debian:12","package":"iperf3","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"iperf3","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"iperf3","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"iperf3","fixed_in":["3.0.7-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"iperf","fixed_in":["3.0.12-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"iperf3","fixed_in":["3.0.11-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"iperf","fixed_in":["3.1.3-6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"iperf","fixed_in":["3.1.3-1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1+deb8u1"}]}],"versions":["3.0.7-1"]},{"source":"osv","ecosystem":"Mageia:5","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1ubuntu0.1~esm1"}]}],"versions":["3.0.11-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"iperf3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1ubuntu0.1~esm1"}]}],"versions":["3.0.11-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"iperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1.3"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"es","product":"iperf3"},{"vendor":"novell","product":"suse_package_hub_for_suse_linux_enterprise"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.talosintelligence.com/reports/TALOS-2016-0164/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://blog.talosintel.com/2016/06/esnet-vulnerability.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://software.es.net/iperf/news.html#security-issue-iperf-3-1-3-iperf-3-0-12-released","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412a","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4303"},{"url":"http://www.talosintelligence.com/reports/TALOS-2016-0164"},{"url":"https://github.com/advisories/GHSA-86rq-gv28-jjr6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4303","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0235.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18743","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4DE6NEEUEC3XI62GE2MB2EK5BUCZ6MCP/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4303","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4788-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/984453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4303","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-06T00:25:14.113Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-5303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-06T00:25:14Z","updated_at":"2026-11-03T02:22:47.294859Z"}],"ghsa":[{"id":"GHSA-86rq-gv28-jjr6","title":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which...","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-13T01:28:44Z","modified":"2025-01-15T21:31:37Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:59:32.92588Z"}],"nvd":[{"id":"CVE-2016-4303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:59:01.553Z","modified":"2026-06-17T00:47:19.017Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"CVE-2016-4303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:59:01.553Z","modified":"2026-10-20T13:15:40.779460509Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:59:01.553Z","modified":"2026-09-22T07:01:03.15280759Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4303","description":"The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.","status":"published","published":"2016-09-26T14:59:00Z","modified":"2026-04-22T10:43:20.514665Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-2080-1","title":"iperf3 - security update","status":"published","published":"2020-01-27T00:00:00Z","modified":"2026-03-09T01:20:24.922479Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2016-0235","title":"Updated iperf packages fix security vulnerability","description":"A malicious process can connect to an iperf server and, by sending a\nmalformed message on the control channel, corrupt the server process's\nheap area.  This can lead to a crash (and a denial of service), or\ntheoretically a remote code execution as the user running the iperf\nserver.  A malicious iperf server could potentially mount a similar\nattack on an iperf client (CVE-2016-4303).\n","status":"published","published":"2016-07-05T15:47:08Z","modified":"2026-04-16T06:24:21.678926283Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2016:2113-1","title":"Security update for iperf","description":"iperf was updated to the the following vulnerability:\n\n- CVE-2016-4303: A malicious client could have triggered a buffer overflow / heap corruption issue by sending a specially crafted JSON string, and possibly execute arbitrary code (boo#984453)","status":"published","published":"2016-08-19T13:27:09Z","modified":"2026-02-04T02:27:40.512387Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2016:2121-1","title":"Security update for iperf","description":"iperf was updated to the the following vulnerability:\n\n- CVE-2016-4303: A malicious client could have triggered a buffer overflow / heap corruption issue by sending a specially crafted JSON string, and possibly execute arbitrary code (boo#984453)","status":"published","published":"2016-08-19T13:27:09Z","modified":"2025-05-07T18:09:20.36578Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10145-1","title":"iperf-3.1.3-1.3 on GA media","description":"These are all security issues fixed in the iperf-3.1.3-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:55.125408Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"USN-4788-1","title":"iperf3 vulnerability","description":"It was discovered that iperf mishandled certain UTF-8 and UTF-16 strings.\nA remote attacker could use this vulnerability to cause a denial of service\nor possibly execute arbitrary code.\n","status":"published","published":"2021-03-15T21:06:51Z","modified":"2026-06-25T13:30:13.529202214Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}