CVE-2016-4074

CVE-2016-4074

EPSS 5.3%

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/hashicorp/consul/issues/10263 https://github.com/NixOS/nixpkgs/pull/18908 https://github.com/stedolan/jq/https://github.com/stedolan/jq/issues/1136 http://www.openwall.com/lists/oss-security/2016/04/24/3 http://www.openwall.com/lists/oss-security/2016/04/24/4