{
  "schema_version": "1.4.0",
  "id": "GHSA-86rq-gv28-jjr6",
  "modified": "2025-01-15T21:31:36Z",
  "published": "2022-05-13T01:28:44Z",
  "aliases": [
    "CVE-2016-4303"
  ],
  "details": "The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412a"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00023.html"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc"
    },
    {
      "type": "WEB",
      "url": "http://blog.talosintel.com/2016/06/esnet-vulnerability.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00082.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00090.html"
    },
    {
      "type": "WEB",
      "url": "http://software.es.net/iperf/news.html#security-issue-iperf-3-1-3-iperf-3-0-12-released"
    },
    {
      "type": "WEB",
      "url": "http://www.talosintelligence.com/reports/TALOS-2016-0164"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-120"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-09-26T14:59:00Z"
  }
}