CVE-2018-1000216

Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
VendorProductVersion
cjson_projectcjson
𝑥
< 1.7.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cjson
bullseye
1.7.14-1+deb11u1
fixed
bookworm
1.7.15-1+deb12u1
fixed
sid
1.7.18-3
fixed
trixie
1.7.18-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cjson
bionic
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://github.com/DaveGamble/cJSON/issues/241
https://github.com/DaveGamble/cJSON/issues/241