CVE-2016-4303: Buffer Overflow
The parsestring function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4303?
CVE-2016-4303 has a high severity rating due to its potential to cause denial of service and execute arbitrary code.
How do I fix CVE-2016-4303?
To resolve CVE-2016-4303, update the cJSON library to a version that has patched the buffer overflow issue.
Which software is affected by CVE-2016-4303?
CVE-2016-4303 affects versions of iperf3 prior to 3.0.12 and from 3.1 to 3.1.3, along with SUSE Linux Enterprise Package Hub and older openSUSE versions.
What type of vulnerability is CVE-2016-4303?
CVE-2016-4303 is a heap-based buffer overflow vulnerability caused by improper handling of UTF8/16 strings.
Can CVE-2016-4303 be exploited remotely?
Yes, CVE-2016-4303 can be exploited remotely by attackers sending malicious JSON strings.