CVE-2018-1000217

published 2018-08-20

CVE-2018-1000217: Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of…

Priority P3 45 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
davegamble	cjson	< 1.7.4	1.7.4
debian	cjson	—	—
msrc	azl3_libglvnd_1.7.0-2_on_azure_linux_3.0	—	—

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_debian 9.8 LOW

vendor_msrc 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416