USN-4360-4: json-c vulnerability
USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a memory leak that was reverted in USN-4360-2 and USN-4360-3. This update provides the correct fix update for CVE-2020-12762. Original advisory details: It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libjson-c4to a version that resolves this vulnerability.Fixed in 0.13.1+dfsg-7ubuntu0.3 - Upgrade
Upgrade
ubuntu/libjson-c4to a version that resolves this vulnerability.Fixed in 0.13.1+dfsg-4ubuntu0.3 - Upgrade
Upgrade
ubuntu/libjson-c3to a version that resolves this vulnerability.Fixed in 0.12.1-1.3ubuntu0.3 - Upgrade
Upgrade
ubuntu/libjson-c2to a version that resolves this vulnerability.Fixed in 0.11-4ubuntu2.6 - Upgrade
Upgrade
ubuntu/libjson0to a version that resolves this vulnerability.Fixed in 0.11-4ubuntu2.6 - Upgrade
Upgrade
ubuntu/libjson-c2to a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/libjson0to a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/libjson0to a version that resolves this vulnerability.Fixed in 0.9-1ubuntu1.4 - Upgrade
Upgrade
json-cto a version that resolves this vulnerability.Patch USN-4360-4
Event History
Frequently Asked Questions
What is the vulnerability ID for this security advisory?
The vulnerability ID for this security advisory is USN-4360-4.
What is the title of this security advisory?
The title of this security advisory is USN-4360-4: json-c vulnerability.
What is the vulnerability that was fixed?
The vulnerability that was fixed is CVE-2020-12762.
Which software versions are affected by this vulnerability?
The software versions affected by this vulnerability are libjson-c4 version 0.13.1+dfsg-7ubuntu0.3, libjson-c4 version 0.13.1+dfsg-4ubuntu0.3, libjson-c3 version 0.12.1-1.3ubuntu0.3, libjson-c2 version 0.11-4ubuntu2.6, libjson0 version 0.11-4ubuntu2.6, libjson-c2 version 0.11-3ubuntu1.2+esm3, libjson0 version 0.11-3ubuntu1.2+esm3, and libjson0 version 0.9-1ubuntu1.4.
How can I fix this vulnerability?
To fix this vulnerability, update libjson-c4 to version 0.13.1+dfsg-7ubuntu0.3 or later, libjson-c4 to version 0.13.1+dfsg-4ubuntu0.3 or later, libjson-c3 to version 0.12.1-1.3ubuntu0.3 or later, libjson-c2 to version 0.11-4ubuntu2.6 or later, libjson0 to version 0.11-4ubuntu2.6 or later, libjson-c2 to version 0.11-3ubuntu1.2+esm3 or later, libjson0 to version 0.11-3ubuntu1.2+esm3 or later, or libjson0 to version 0.9-1ubuntu1.4 or later.