CVE-2023-50268

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120 CWE-121 CWE-787

Affected software

Vendor	Product	Versions
jqlang	jq	= 1.7

References

http://www.openwall.com/lists/oss-security/2023/12/15/10Mailing List, Patch, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771Issue Tracking, Mailing List
https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6bPatch
https://github.com/jqlang/jq/pull/2804Issue Tracking, Patch
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8jExploit, Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/15/10Mailing List, Patch, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771Issue Tracking, Mailing List
https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6bPatch
https://github.com/jqlang/jq/pull/2804Issue Tracking, Patch
https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8jExploit, Vendor Advisory

Timeline

Published: Dec 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-502697.5Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, an CVE-2023-50277.5A vulnerability classified as critical was found in SourceCodester Simple Membership System 1.0. Affected by this vulnerability is an unknow CVE-2023-502706.5Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommende CVE-2023-502717.5A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited lo CVE-2023-502729.8A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulne CVE-2023-502747.8HPE OneView may allow command injection with local privilege escalation.CVE-2023-502757.5HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.CVE-2023-50284.6A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue CVE-2023-50298.8A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/cop CVE-2023-502906.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected envi CVE-2023-502917.5Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 be CVE-2023-502927.5Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.