CVE-2024-53427: Buffer Overflow
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53427?
CVE-2024-53427 has a high severity rating due to its potential for causing stack-based buffer overflows.
How do I fix CVE-2024-53427?
To fix CVE-2024-53427, upgrade jq to version 1.7.2 or later.
What types of software are affected by CVE-2024-53427?
CVE-2024-53427 affects jq versions up to and including 1.7.1.
What exploitation conditions are required for CVE-2024-53427?
Exploitation of CVE-2024-53427 requires specific input that triggers the buffer overflow during subtraction operations.
Is CVE-2024-53427 easily exploitable?
Yes, CVE-2024-53427 can be easily exploited if the software processes crafted input in a vulnerable manner.