CVE-2024-25713

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-25713
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25713.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-25713
Aliases
Related
  • GHSA-q4m7-9pcm-fpxh
Published
2024-02-29T01:44:16.333Z
Modified
2026-03-14T12:27:43.725501Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
[none]
Details

yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the poolfree function lacks loop checks. (poolfree is part of the pool series allocator, along with poolmalloc and poolrealloc.)

References

Affected packages

Git / github.com/ibireme/yyjson

Affected ranges

Type
GIT
Repo
https://github.com/ibireme/yyjson
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e01ae9d89eaf858894d366169329097171a28d67
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "38"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "39"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "40"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25713.json"