Bug 920064 (CVE-2023-50246, CVE-2023-50268)

Summary:	<app-misc/jq-1.7.1: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Christopher Fore <csfore>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	chutzpah, vpayno+gentoo
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j
Whiteboard:	A4 [stable?]
Package list:		Runtime testing required:	---

Description Christopher Fore 2023-12-15 23:13:25 UTC

CVE-2023-50246 (https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc):

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.


CVE-2023-50268 (https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j):

jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.