ALAS-2014-416


Amazon Linux 1 Security Advisory: ALAS-2014-416
Advisory Release Date: 2014-09-18 21:04 Pacific
Advisory Updated Date: 2014-09-19 12:11 Pacific
Severity: Medium

Issue Overview:

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.

Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.


Affected Packages:

json-c


Issue Correction:
Run yum update json-c to update your system.

New Packages:
i686:
    json-c-debuginfo-0.11-6.8.amzn1.i686
    json-c-0.11-6.8.amzn1.i686
    json-c-devel-0.11-6.8.amzn1.i686

noarch:
    json-c-doc-0.11-6.8.amzn1.noarch

src:
    json-c-0.11-6.8.amzn1.src

x86_64:
    json-c-debuginfo-0.11-6.8.amzn1.x86_64
    json-c-0.11-6.8.amzn1.x86_64
    json-c-devel-0.11-6.8.amzn1.x86_64