CVE-2023-50246

概要

参考情報

• openwall.com/lists/oss-security/2023/12/15/10 · Mailing List
• bugs.chromium.org/p/oss-fuzz/issues/detail · Mailing List
• jqlang/jq commit 71c2ab5 · Patch
• jqlang/jq security advisory · Exploit

jq のその他の脆弱性

• CVE-2026-54679中 5.5jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and the…
• CVE-2026-49839高 7.1jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a…
• CVE-2026-47770中 5.5jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C sta…
• CVE-2026-44777中 5.5jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise…
• CVE-2026-43896中 5.5jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to…