CVE-2016-4074 - Vulnerability Details - OpenCVE

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Jq Project	Jq

Configuration 1 [-]

cpe:2.3:a:jq_project:jq:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2016/04/24/3
http://www.openwall.com/lists/oss-security/2016/04/24/4
https://github.com/NixOS/nixpkgs/pull/18908
https://github.com/hashicorp/consul/issues/10263
https://github.com/stedolan/jq/
https://github.com/stedolan/jq/issues/1136
https://nvd.nist.gov/vuln/detail/CVE-2016-4074
https://www.cve.org/CVERecord?id=CVE-2016-4074

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-05-06T17:00:00

Updated: 2024-08-06T00:17:30.898Z

Reserved: 2016-04-24T00:00:00

Link: CVE-2016-4074

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-05-06T17:59:07.303

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-4074

Redhat

Severity : Low

Publid Date: 2016-04-24T00:00:00Z

Links: CVE-2016-4074 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-04-24T00:00:00", "descriptions": [{"lang": "en", "value": "The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-02-04T15:48:58", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/4"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/stedolan/jq/issues/1136"}, {"name": "[oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/3"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/stedolan/jq/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/NixOS/nixpkgs/pull/18908"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/hashicorp/consul/issues/10263"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-4074", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/04/24/4"}, {"name": "https://github.com/stedolan/jq/issues/1136", "refsource": "MISC", "url": "https://github.com/stedolan/jq/issues/1136"}, {"name": "[oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/04/24/3"}, {"name": "https://github.com/stedolan/jq/", "refsource": "MISC", "url": "https://github.com/stedolan/jq/"}, {"name": "https://github.com/NixOS/nixpkgs/pull/18908", "refsource": "MISC", "url": "https://github.com/NixOS/nixpkgs/pull/18908"}, {"name": "https://github.com/hashicorp/consul/issues/10263", "refsource": "MISC", "url": "https://github.com/hashicorp/consul/issues/10263"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:17:30.898Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/4"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/stedolan/jq/issues/1136"}, {"name": "[oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/stedolan/jq/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/NixOS/nixpkgs/pull/18908"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hashicorp/consul/issues/10263"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-4074", "datePublished": "2016-05-06T17:00:00", "dateReserved": "2016-04-24T00:00:00", "dateUpdated": "2024-08-06T00:17:30.898Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jq_project:jq:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF54817B-2574-48EC-AB56-D080733E0C2D", "versionEndIncluding": "1.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0."}, {"lang": "es", "value": "La funci\u00f3n jv_dump_term de jq 1.5 permite a los atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de pila y ca\u00edda de la aplicaci\u00f3n) a trav\u00e9s de un archivo JSON manipulado. Este problema ha sido corregido en jg 1.6_rc1-r0"}], "id": "CVE-2016-4074", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-05-06T17:59:07.303", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/3"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/4"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NixOS/nixpkgs/pull/18908"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/hashicorp/consul/issues/10263"}, {"source": "cve@mitre.org", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/stedolan/jq/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/stedolan/jq/issues/1136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/04/24/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NixOS/nixpkgs/pull/18908"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/hashicorp/consul/issues/10263"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/stedolan/jq/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/stedolan/jq/issues/1136"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}