AZL-57376
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-57376.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-57376
- Upstream
- Published
- 2025-02-26T16:15:16Z
- Modified
- 2026-04-21T04:36:54.844427Z
- Summary
- CVE-2024-53427 affecting package jq for versions less than 1.7.1-2
- Details
-
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
- References