{"id":"MGASA-2014-0175","summary":"Updated json-c packages fix security vulnerabilities","details":"Updated json-c packages fix security vulnerabilities:\n\nFlorian Weimer reported that the printbuf APIs used in the json-c library used\nints for counting buffer lengths, which is inappropriate for 32bit\narchitectures.  These functions need to be changed to using size_t if possible\nfor sizes, or to be hardened against negative values if not.  This could be\nused to cause a denial of service in an application linked to the json-c\nlibrary (CVE-2013-6370).\n\nFlorian Weimer reported that the hash function in the json-c library was weak,\nand that parsing smallish JSON strings showed quadratic timing behaviour.\nThis could cause an application linked to the json-c library, and that\nprocesses some specially-crafted JSON data, to use excessive amounts of CPU\n(CVE-2013-6371).\n","modified":"2026-04-16T06:23:53.851398424Z","published":"2014-04-16T13:08:14Z","upstream":["CVE-2013-6370","CVE-2013-6371"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0175.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032322"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032311"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13179"}],"affected":[{"package":{"name":"json-c","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/json-c?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11-1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0175.json"}},{"package":{"name":"json-c","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/json-c?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11-3.1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0175.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}