CVE-2020-12762CWE-190CWE-787

CVE-2020-12762

High · published May 9, 2020

CVSS v3.1
7.8
EPSS
2%
Percentile
79.5
In the wild
Unconfirmed
What it is

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01895 · 79.5th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-787 · Out-of-bounds Write
Published
2020-05-09T22:15Z
Affected products (16)
ProductVersionsFixed in
json-c/json-c< 0.15-202007260.15-20200726
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
References (35)
https://www.debian.org/security/2020/dsa-4741 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-202008.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-637483.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf · [email protected]https://github.com/json-c/json-c/pull/592 · [email protected]https://github.com/rsyslog/libfastjson/issues/161 · [email protected]https://lists.debian.org/debian-lts-announce/2020/05/msg00032.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/05/msg00034.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/07/msg00031.html · [email protected]https://lists.debian.org/debian-lts-announce/2023/06/msg00023.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS/ · [email protected]https://security.gentoo.org/glsa/202006-13 · [email protected]https://security.netapp.com/advisory/ntap-20210521-0001/ · [email protected]https://usn.ubuntu.com/4360-1/ · [email protected]https://usn.ubuntu.com/4360-4/ · [email protected]https://www.debian.org/security/2020/dsa-4741 · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf · af854a3a-2127-422b-91ae-364da2661108https://github.com/json-c/json-c/pull/592 · af854a3a-2127-422b-91ae-364da2661108https://github.com/rsyslog/libfastjson/issues/161 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/05/msg00032.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/05/msg00034.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/07/msg00031.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/06/msg00023.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/07/msg00021.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-13 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210521-0001/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4360-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4360-4/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 MAY 00:00Z
    json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend
    cvelistv5