Advisories ยป MGASA-2014-0175

Updated json-c packages fix security vulnerabilities

Publication date: 16 Apr 2014
Modification date: 16 Apr 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2013-6370 , CVE-2013-6371

Description

Updated json-c packages fix security vulnerabilities:

Florian Weimer reported that the printbuf APIs used in the json-c library used
ints for counting buffer lengths, which is inappropriate for 32bit
architectures.  These functions need to be changed to using size_t if possible
for sizes, or to be hardened against negative values if not.  This could be
used to cause a denial of service in an application linked to the json-c
library (CVE-2013-6370).

Florian Weimer reported that the hash function in the json-c library was weak,
and that parsing smallish JSON strings showed quadratic timing behaviour.
This could cause an application linked to the json-c library, and that
processes some specially-crafted JSON data, to use excessive amounts of CPU
(CVE-2013-6371).

References

SRPMS

3/core

4/core