ALT-PU-2025-7731-3
Closed vulnerabilities
BDU:2025-06686
Уязвимость функции jv_string_vfmt функционального языка программирования jq, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-06690
Уязвимость функции decNumberCopy функционального языка программирования jq, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-06692
Уязвимость функционального языка программирования jq, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-06-20
CVE-2024-23337
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
Modified: 2025-07-01
CVE-2024-53427
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
- https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92
- https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375
- https://github.com/jqlang/jq/issues/3196
- https://github.com/jqlang/jq/issues/3296
- https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22
Modified: 2025-06-20
CVE-2025-48060
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.