|Category:||Red Hat Local Security Checks|
|Title:||RedHat Update for json-c RHSA-2014:0703-01|
|Summary:||The remote host is missing an update for the 'json-c'; package(s) announced via the referenced advisory.|
The remote host is missing an update for the 'json-c'
package(s) announced via the referenced advisory.
JSON-C implements a reference counting object model that allows you to
easily construct JSON objects in C, output them as JSON-formatted strings,
and parse JSON-formatted strings back into the C representation of
Multiple buffer overflow flaws were found in the way the json-c library
handled long strings in JSON documents. An attacker able to make an
application using json-c parse excessively large JSON input could cause the
application to crash. (CVE-2013-6370)
A denial of service flaw was found in the implementation of hash arrays in
json-c. An attacker could use this flaw to make an application using json-c
consume an excessive amount of CPU time by providing a specially crafted
JSON document that triggers multiple hash function collisions. To mitigate
this issue, json-c now uses a different hash function and randomization to
reduce the chance of an attacker successfully causing intentional
These issues were discovered by Florian Weimer of the Red Hat Product
All json-c users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.
json-c on Red Hat Enterprise Linux Server (v. 7)
Please Install the Updated Packages.
Common Vulnerability Exposure (CVE) ID: CVE-2013-6370|
BugTraq ID: 66720
XForce ISS Database: jsonc-cve20136370-bo(92540)
Common Vulnerability Exposure (CVE) ID: CVE-2013-6371
BugTraq ID: 66715
XForce ISS Database: jsonc-cve20136371-dos(92541)
|Copyright||Copyright (C) 2014 Greenbone Networks GmbH|
|This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.