CVE-2015-8863: Buffer Overflow
Off-by-one error in the tokenadd function in jvparse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8863?
CVE-2015-8863 has a medium severity rating because it can lead to a denial of service through a heap-based buffer overflow.
How do I fix CVE-2015-8863?
To fix CVE-2015-8863, upgrade jq to version 1.6-2.1 or later if you are using Debian or ensure you are using a version higher than 1.5 in other distributions.
What software is affected by CVE-2015-8863?
CVE-2015-8863 affects jq versions up to and including 1.5 and versions of jq used in specific distributions like Debian and openSUSE.
What kind of attack does CVE-2015-8863 enable?
CVE-2015-8863 allows remote attackers to execute a denial of service attack by exploiting an off-by-one error in the tokenadd function.
Is CVE-2015-8863 still a threat today?
While CVE-2015-8863 has been addressed in newer versions, systems running vulnerable versions remain at risk if not updated.