Aller au contenu
en Se connecter
8.1 Élevée

CVE-2024-53427 decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which…

Description

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

Produits et versions touchés

Produit Versions touchées Corrigé en
jq 1.7 premières → 1.7.1 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de jq

Les 23 CVE de jq →
CVE-2026-47770 jq is a command-line JSON processor 6.8 Moyenne CVE-2026-49839 jq is a command-line JSON processor 7.1 Élevée CVE-2026-54679 jq is a command-line JSON processor 6.9 Moyenne CVE-2026-43896 jq is a command-line JSON processor 6.2 Moyenne
Suivre cette CVE