CVE-2023-50268

Published: Dic 13, 2023 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2023-55080 Aliases: GSD-2023-50268
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,2
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0010
Percentile
0,3th
Updated

EPSS Score Trend (Last 90 Days)

120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
121

Stack-based Buffer Overflow

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Modify Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Execute Unauthorized Code Or Commands Bypass Protection Mechanism Other
Applicable Platforms
Languages: C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
787

Out-of-bounds Write

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
Application

Jq by Jqlang

Product Information
Vendor Jqlang
Product Jq
Version 1.7
cpe:2.3:a:jqlang:jq:1.7:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
Issue Tracking Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
https://github.com/jqlang/jq/commit/c9a51565214eece8f105308…
Patch
https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b
https://github.com/jqlang/jq/pull/2804
Issue Tracking Patch
https://github.com/jqlang/jq/pull/2804
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-…
Exploit Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j
http://www.openwall.com/lists/oss-security/2023/12/15/10
Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
Issue Tracking Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
https://github.com/jqlang/jq/commit/c9a51565214eece8f105308…
Patch
https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b
https://github.com/jqlang/jq/pull/2804
Issue Tracking Patch
https://github.com/jqlang/jq/pull/2804
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-…
Exploit Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j
http://www.openwall.com/lists/oss-security/2023/12/15/10
Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10