Most recent entries from all

ALSA-2025:10585 — Moderate: jq security update

Affected: AlmaLinux:9: jq, AlmaLinux:9: jq-devel

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

* jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337) * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-06692

BELL-CVE-2024-23337

Affected: Alpaquita:23: jq, Alpaquita:25: jq, Alpaquita:stream: jq

certfr-2025-avi-0622 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2025-avi-0622

EUVD-2026-240643

fkie_cve-2024-23337

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

gsd-2024-23337

msrc_CVE-2024-23337 — jq has signed integer overflow in jv.c:jvp_array_write

msrc_CVE-2024-23337

OESA-2025-1809 — jq security update

Affected: openEuler:22.03-LTS-SP3: jq, openEuler:22.03-LTS-SP4: jq, openEuler:24.03-LTS: jq, openEuler:24.03-LTS-SP1: jq, openEuler:24.03-LTS-SP2: jq, openEuler:20.03-LTS-SP4: jq

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want. Security Fix(es):

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.(CVE-2025-48060)

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.(CVE-2025-49014)

openSUSE-SU-2025:15233-1 — jq-1.8.1-1.1 on GA media

jq-1.8.1-1.1 on GA media

RHSA-2025:10613 — Red Hat Security Advisory: jq security update

jq: jq has signed integer overflow in jv.c:jvp_array_write jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)

SUSE-SU-2025:20506-1 — Security update for jq

Security update for jq

UBUNTU-CVE-2024-23337

Affected: Ubuntu:Pro:16.04:LTS: jq, Ubuntu:Pro:18.04:LTS: jq, Ubuntu:Pro:20.04:LTS: jq, Ubuntu:22.04:LTS: jq, Ubuntu:24.04:LTS: jq

VDE-2025-077 — Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices

The jq JSON processor, which is used to migrate firmware configurations in the product, contains 2 vulnerabilities that can be exploited by an authenticated attacker.

WID-SEC-W-2025-1480 — Red Hat Enterprise Linux (jq): Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (jq) ausnutzen, um einen Denial of Service Angriff durchzuführen.