CVE-2020-12762
09.05.2020, 18:15
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| json-c | json-c | 𝑥 < 0.15-20200726 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.10 |
| canonical | ubuntu_linux | 20.04 |
| siemens | sinec_ins | - |
| siemens | sinec_ins | 1.0 |
| siemens | sinec_ins | 1.0:sp1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 ≤ 𝑥 < V3.1.5 | ADP |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.0 ≤ 𝑥 < V3.1.5 | ADP |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | 𝑥 < V1.1 | ADP |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 ≤ 𝑥 < V3.1.5 | ADP |
| Siemens | RUGGEDCOM ROX MX5000 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX MX5000RE | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1400 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1500 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1501 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1510 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1511 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1512 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1524 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX1536 | 𝑥 < V2.17.0 | ADP |
| Siemens | RUGGEDCOM ROX RX5000 | 𝑥 < V2.17.0 | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libfastjson-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libfastjson4 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c2 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c2-32bit |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c3 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c3-32bit |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c5 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libjson-c5-32bit |
|
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Amazon Package | |||||||
|---|---|---|---|---|---|---|---|
| json-c |
| ||||||
| json-c-debuginfo |
| ||||||
| json-c-debugsource |
| ||||||
| json-c-devel |
| ||||||
| json-c-doc |
| ||||||
| libfastjson |
| ||||||
| libfastjson-debuginfo |
| ||||||
| libfastjson-debugsource |
| ||||||
| libfastjson-devel |
|
Azure Linux Releases
Common Weakness Enumeration
- CWE-190 - Integer Overflow or WraparoundThe software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.
References