CVE-2025-49014: falha de média gravidade em jqlang jq
jq heap use after free vulnerability in f_strflocaltime
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.4%
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
jqlang · jqCVEs relacionadas — jqlang jq
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32316HIGHjq: Integer overflow in jvp_string_append() allows Heap-based Buffer OverflowEPSS 0.8%CVE-2026-39979MEDIUMjq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersEPSS 0.6%CVE-2025-48060HIGHAddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)EPSS 0.6%CVE-2023-50246MEDIUMjq has heap-buffer-overflow vulnerability in the function decToString in decNumber.cEPSS 0.5%CVE-2024-23337MEDIUMjq has signed integer overflow in jv.c:jvp_array_writeEPSS 0.5%CVE-2023-50268MEDIUMjq has stack-based buffer overflow in decNaNsEPSS 0.4%