Summary
USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a
memory leak that was reverted in USN-4360-2 and USN-4360-3. This update provides
the correct fix update for CVE-2020-12762.
Original advisory details:
It was discovered that json-c incorrectly handled certain JSON files.
An attacker could possibly use this issue to execute arbitrary code.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | json-c | 0.11-4ubuntu2.6 |
| Ubuntu · 18.04 LTS 18.04:LTS | json-c | 0.12.1-1.3ubuntu0.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | json-c | 0.13.1+dfsg-7ubuntu0.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | json-c | 0.11-3ubuntu1.2+esm3 |
Vulnerabilities 1
-
High 7.8
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_…
References
-
report
https://ubuntu.com/security/CVE-2020-12762