CVE-2023-50472: Null Pointer Dereference
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONSetValuestring at cJSON.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/cjsonto a version that resolves this vulnerability.Fixed in 1.7.15-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/cjsonto a version that resolves this vulnerability.Fixed in 1.7.16-1ubuntu0.2 - Upgrade
Upgrade
ubuntu/cjsonto a version that resolves this vulnerability.Fixed in 1.7.17 - Upgrade
Upgrade
debian/cjsonto a version that resolves this vulnerability.Fixed in 1.7.14-1+deb11u1Fixed in 1.7.15-1+deb12u1Fixed in 1.7.18-3
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50472?
CVE-2023-50472 is classified as a high severity vulnerability due to its potential to cause segmentation violations in cJSON v1.7.16.
How do I fix CVE-2023-50472?
To fix CVE-2023-50472, upgrade cJSON to version 1.7.17 or later.
What versions of cJSON are affected by CVE-2023-50472?
CVE-2023-50472 affects cJSON versions prior to 1.7.17, including version 1.7.16.
Which operating systems are impacted by CVE-2023-50472?
CVE-2023-50472 affects cJSON packages on Ubuntu and Debian systems that use vulnerable versions.
Is CVE-2023-50472 publicly known?
Yes, CVE-2023-50472 is publicly disclosed and details about it can be found in vulnerability databases.