MGASA-2014-0175

Dashboard / Vulnerabilities / MGASA-2014-0175

MGASA-2014-0175

Summary: Updated json-c packages fix security vulnerabilities

Details: Updated json-c packages fix security vulnerabilities: Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using size_t if possible for sizes, or to be hardened against negative values if not. This could be used to cause a denial of service in an application linked to the json-c library (CVE-2013-6370). Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially-crafted JSON data, to use excessive amounts of CPU (CVE-2013-6371).

References: https://advisories.mageia.org/MGASA-2014-0175.html, https://bugzilla.redhat.com/show_bug.cgi?id=1032322, https://bugzilla.redhat.com/show_bug.cgi?id=1032311, https://bugs.mageia.org/show_bug.cgi?id=13179