Summary
USN-7657-1 fixed CVE-2024-23337 and CVE-2025-48060 in jq. This update
provides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could possibly use this issue to cause jq to
crash, resulting in a denial of service. (CVE-2024-23337)
It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could use this issue to cause jq to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2025-48060)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | jq | 1.5+dfsg-1ubuntu0.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | jq | 1.5+dfsg-2ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | jq | 1.6-1ubuntu0.20.04.1+esm1 |
Vulnerabilities 2
-
High 7.7CVE-2025-48060 Public exploit
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of …
-
Medium 4.3
jq has signed integer overflow in jv.c:jvp_array_write
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1…