DescriptionThe parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs827116

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iperf3 (PTS)buster3.6-2fixed
buster (security)3.6-2+deb10u1fixed
bullseye (security), bullseye3.9-1+deb11u1fixed
bookworm, bookworm (security)3.12-1+deb12u1fixed
sid, trixie3.17.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Notes (3.1.x)

Search for package or bug name: Reporting problems