CVE-2023-50246

Published: Dic 13, 2023 Last Modified: Apr 25, 2025 EU-VD ID: EUVD-2023-55064 Aliases: GSD-2023-50246
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,2
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0026
Percentile
0,5th
Updated

EPSS Score Trend (Last 90 Days)

120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
122

Heap-based Buffer Overflow

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Execute Unauthorized Code Or Commands Bypass Protection Mechanism Modify Memory Other
Applicable Platforms
Languages: C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
787

Out-of-bounds Write

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
Application

Jq by Jqlang

Product Information
Vendor Jqlang
Product Jq
Version 1.7
cpe:2.3:a:jqlang:jq:1.7:rc2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Jq by Jqlang

Product Information
Vendor Jqlang
Product Jq
Version 1.7
cpe:2.3:a:jqlang:jq:1.7:rc1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Jq by Jqlang

Product Information
Vendor Jqlang
Product Jq
Version 1.7
cpe:2.3:a:jqlang:jq:1.7:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7…
Patch
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
https://github.com/jqlang/jq/security/advisories/GHSA-686w-…
Exploit Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc
http://www.openwall.com/lists/oss-security/2023/12/15/10
Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7…
Patch
https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
https://github.com/jqlang/jq/security/advisories/GHSA-686w-…
Exploit Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc
http://www.openwall.com/lists/oss-security/2023/12/15/10
Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10