CVE-2017-16516

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-16516

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16516.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-16516

Aliases

GHSA-wwh7-4jw9-33x6

Related

Published

2017-11-03T15:29:00Z

Modified

2024-10-28T21:45:22.458298Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.

References

Affected packages

Debian:11 / burp

Package

Name: burp
Purl: pkg:deb/debian/burp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.18-8

2.4.0-3

3.*

3.1.4-1

3.1.4-3

3.1.4-3.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / burp

Package

Name: burp
Purl: pkg:deb/debian/burp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.4-1

3.1.4-3

3.1.4-3.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / burp

Package

Name: burp
Purl: pkg:deb/debian/burp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.4-2

Affected versions

3.*

3.1.4-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / r-cran-jsonlite

Package

Name: r-cran-jsonlite
Purl: pkg:deb/debian/r-cran-jsonlite?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.2+dfsg-1

1.7.3+dfsg-1

1.8.0+dfsg-1

1.8.2+dfsg-1

1.8.3+dfsg-1

1.8.4+dfsg-1

1.8.5+dfsg-1

1.8.7+dfsg-1

1.8.8+dfsg-1

1.8.9+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / r-cran-jsonlite

Package

Name: r-cran-jsonlite
Purl: pkg:deb/debian/r-cran-jsonlite?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.4+dfsg-1

1.8.5+dfsg-1

1.8.7+dfsg-1

1.8.8+dfsg-1

1.8.9+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / r-cran-jsonlite

Package

Name: r-cran-jsonlite
Purl: pkg:deb/debian/r-cran-jsonlite?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.8+dfsg-1

Affected versions

1.*

1.8.4+dfsg-1

1.8.5+dfsg-1

1.8.7+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / ruby-yajl

Package

Name: ruby-yajl
Purl: pkg:deb/debian/ruby-yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.0-3.1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / ruby-yajl

Package

Name: ruby-yajl
Purl: pkg:deb/debian/ruby-yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.0-3.1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / ruby-yajl

Package

Name: ruby-yajl
Purl: pkg:deb/debian/ruby-yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.0-3.1

Ecosystem specific

{
    "urgency": "low"
}

Debian:11 / yajl

Package

Name: yajl
Purl: pkg:deb/debian/yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.0-3+deb11u2

Affected versions

2.*

2.1.0-3

2.1.0-3+deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / yajl

Package

Name: yajl
Purl: pkg:deb/debian/yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.0-3+deb12u2

Affected versions

2.*

2.1.0-3

2.1.0-3+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / yajl

Package

Name: yajl
Purl: pkg:deb/debian/yajl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.0-4

Affected versions

2.*

2.1.0-3

2.1.0-3.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/brianmario/yajl-ruby

Affected ranges

Type: GIT
Repo: https://github.com/brianmario/yajl-ruby
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

35cf1c23efbf946785d3210b610783fedde51321

Affected versions

0.*

0.1.0

0.2.0

0.2.1

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.8

0.4.9

0.5.0

0.5.1

0.5.10

0.5.11

0.5.12

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.5.7

0.5.8

0.5.9

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

0.6.9

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.7.5

0.7.6

0.7.7

0.7.8

0.7.9

0.8.0

0.8.1

0.8.2

0.8.3

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.3.0