CVE-2016-4303
Fixed in a distro release EPSS 7%
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Products: es iperf3, novell suse_package_hub_for_suse_linux_enterprise, opensuse leap, opensuse, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | iperf3 | 3.1.3-1 |
| Debian 13 | iperf3 | 3.1.3-1 |
| Debian 14 | iperf3 | 3.1.3-1 |
| Debian 8 | iperf3 | 3.0.7-1+deb8u1 |
| SUSE Package Hub 12 | iperf | 3.1.3-6.1 |
| Ubuntu Pro 16.04 LTS | iperf3 | 3.0.11-1ubuntu0.1~esm1 |
| openSUSE Tumbleweed | iperf | 3.1.3-1.3 |