CVE-2015-8863 Memory corruption in n/a
Remote attackers can cause a denial of service via a heap-based buffer overflow in the jq JSON processor triggered by long JSON-encoded numbers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8863?
CVE-2015-8863 is a critical memory corruption vulnerability in Opensuse Leap, published on 6 May 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Weakness: CWE-119
Which versions are affected by CVE-2015-8863?
It affects 3 products.
Linux distribution packages (7)
jq Red Hat:openstack:6::el7 | All versions | 0:1.3-3.el7ost |
jq-debuginfo Red Hat:openstack:6::el7 | All versions | 0:1.3-3.el7ost |
jq Red Hat:openstack:7::el7 | All versions | 0:1.3-3.el7ost |
jq-debuginfo Red Hat:openstack:7::el7 | All versions | 0:1.3-3.el7ost |
jq Red Hat:openstack:8::el7 | All versions | 0:1.3-3.el7ost |
jq-debuginfo Red Hat:openstack:8::el7 | All versions | 0:1.3-3.el7ost |
jq openSUSE:Tumbleweed | All versions | 1.5-3.3 |
Products include Jq Project Jq, Opensuse Leap, Opensuse Opensuse.
How do I fix CVE-2015-8863?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-8863 being exploited?
There is no known exploitation of CVE-2015-8863 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as AZL-6504, DEBIAN-CVE-2015-8863, GHSA-j4rg-46c3-r5vq, RHSA-2016:1098, RHSA-2016:1099, RHSA-2016:1106 and 2 more.