CVE-2013-6371

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
VendorProductVersion
json-cjson-c
𝑥
< 0.12-20140410
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
json-c
bullseye (security)
0.15-2+deb11u1
fixed
bullseye
0.15-2+deb11u1
fixed
wheezy
no-dsa
squeeze
no-dsa
bookworm
0.16-2
fixed
sid
0.18+ds-1
fixed
trixie
0.18+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
json-c
trusty
Fixed 0.11-3ubuntu1.2
released
saucy
Fixed 0.11-2ubuntu1.2
released
quantal
ignored
precise
Fixed 0.9-1ubuntu1.1
released
lucid
ignored
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
http://secunia.com/advisories/57791
http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/66715
https://bugzilla.redhat.com/show_bug.cgi?id=1032311
https://exchange.xforce.ibmcloud.com/vulnerabilities/92541
https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015
http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
http://secunia.com/advisories/57791
http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/66715
https://bugzilla.redhat.com/show_bug.cgi?id=1032311
https://exchange.xforce.ibmcloud.com/vulnerabilities/92541
https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015