CVE-2018-1000216

EUVD-2018-1886
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
davegamblecjson
𝑥
< 1.7.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cjson
bookworm
1.7.15-1+deb12u1
fixed
bullseye
1.7.14-1+deb11u1
fixed
sid
1.7.18-3
fixed
trixie
1.7.18-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cjson
bionic
dne
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://github.com/DaveGamble/cJSON/issues/241
https://github.com/DaveGamble/cJSON/issues/241