CVE-2021-32292 — Out-of-bounds Write in Json-c

CWE-787 — Out-of-bounds WriteCWE-121 — Stack-based Buffer OverflowCWE-125 — Out-of-bounds Read7 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 61.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Json-cDebian Json-cMsrc Azl3 Ntopng 5.2.1-5 ON Azure Linux 3.0+1 more
Timeline
PublishedAug 22
Latest updateAug 28

Description

An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/json-c< json-c 0.16-1 (bookworm)
▶Debianjson-c/json-c< 0.15-2+deb11u1+3
▶NVDjson-c/json-c0.15-20200726

🔴Vulnerability Details

2
OSV
CVE-2021-32292: An issue was discovered in json-c from 20200420 (post 0↗2023-08-22
▶
GHSA
GHSA-gf2h-qrq9-jg6v: An issue was discovered in json-c through 0↗2023-08-22
▶

📋Vendor Advisories

4
Ubuntu
json-c vulnerability↗2023-08-28
▶
Red Hat
json-c: stack-buffer-overflow in parseit() in json_parse.c↗2023-08-22
▶
Microsoft
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the fun↗2023-08-08
▶
Debian
CVE-2021-32292: json-c - An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) thro...↗2021
▶