CVE catalog

CVE-2020-12762

json-c: CVE-2020-12762

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.90% · Oct 25, 2026

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjson-csid0.19+ds-1fixed
Debianjson-cforky0.19+ds-1fixed
Debianjson-ctrixie0.18+ds-1fixed
Debianjson-cbookworm0.16-2fixed
Debianlibfastjsonsid1.2609.0-1fixed
Debianlibfastjsonforky1.2609.0-1fixed
Debianlibfastjsontrixie1.2304.0-2fixed
Debianlibfastjsonbookworm1.2304.0-1fixed
Cpejson-cNot reported0.15-20200726fixed
CpefedoraNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Cpesinec_insNot reportedNot reportedunknown
Alpinejson-c3.100.13.1-r1fixed
Alpinejson-c3.110.13.1-r1fixed
Alpinejson-c3.120.14-r1fixed
Alpinejson-c3.130.14-r1fixed
Alpinejson-c3.140.14-r1fixed
Alpinejson-c3.150.14-r1fixed
Alpinejson-c3.160.14-r1fixed
Alpinejson-c3.170.14-r1fixed
Alpinejson-c3.180.14-r1fixed
Alpinejson-c3.190.14-r1fixed
Alpinejson-c3.200.14-r1fixed
Alpinejson-c3.210.14-r1fixed
Alpinejson-c3.220.14-r1fixed
Alpinejson-c3.230.14-r1fixed
Alpinejson-c3.240.14-r1fixed
Alpinejson-c3.90.13.1-r1fixed
Alpinelibfastjson3.151.2304.0-r0fixed
Alpinelibfastjson3.161.2304.0-r0fixed
Alpinelibfastjson3.171.2304.0-r0fixed
Alpinelibfastjson3.181.2304.0-r0fixed
Alpinelibfastjson3.191.2304.0-r0fixed
Alpinelibfastjson3.201.2304.0-r0fixed
Alpinelibfastjson3.211.2304.0-r0fixed
Alpinelibfastjson3.221.2304.0-r0fixed
Alpinelibfastjson3.231.2304.0-r0fixed
Alpinelibfastjson3.241.2304.0-r0fixed
Ubuntujson-cpro0.11-2ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm1vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm2vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm3fixed
Ubuntujson-c16.040.11-4ubuntu2vulnerable
Ubuntujson-c16.040.11-4ubuntu2.1vulnerable
Ubuntujson-c16.040.11-4ubuntu2.2vulnerable
Ubuntujson-c16.040.11-4ubuntu2.5vulnerable
Ubuntujson-c16.040.11-4ubuntu2.6fixed
Ubuntujson-c18.040.12.1-1.2vulnerable
Ubuntujson-c18.040.12.1-1.3vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.1vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.2vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.3fixed
Ubuntujson-c20.040.13.1+dfsg-4vulnerable
Ubuntujson-c20.040.13.1+dfsg-6vulnerable
Ubuntujson-c20.040.13.1+dfsg-7vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.1vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.2vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.3fixed
Ubuntujson-cpro0.11-2ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm1fixed
Ubuntujson-c16.040.11-4ubuntu2vulnerable
Ubuntujson-c16.040.11-4ubuntu2.1fixed
Ubuntujson-c18.040.12.1-1.2vulnerable
Ubuntujson-c18.040.12.1-1.3vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.1fixed
Ubuntujson-c20.040.13.1+dfsg-4vulnerable
Ubuntujson-c20.040.13.1+dfsg-6vulnerable
Ubuntujson-c20.040.13.1+dfsg-7vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.1fixed
Ubuntujson-cpro0.11-2ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm1vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm2vulnerable
Ubuntujson-cpro0.11-3ubuntu1.2+esm3fixed
Ubuntujson-c16.040.11-4ubuntu2vulnerable
Ubuntujson-c16.040.11-4ubuntu2.1vulnerable
Ubuntujson-c16.040.11-4ubuntu2.2vulnerable
Ubuntujson-c16.040.11-4ubuntu2.5vulnerable
Ubuntujson-c16.040.11-4ubuntu2.6fixed
Ubuntujson-c18.040.12.1-1.2vulnerable
Ubuntujson-c18.040.12.1-1.3vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.1vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.2vulnerable
Ubuntujson-c18.040.12.1-1.3ubuntu0.3fixed
Ubuntujson-c20.040.13.1+dfsg-4vulnerable
Ubuntujson-c20.040.13.1+dfsg-6vulnerable
Ubuntujson-c20.040.13.1+dfsg-7vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.1vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.2vulnerable
Ubuntujson-c20.040.13.1+dfsg-7ubuntu0.3fixed
Suselibfastjsonlinux enterprise high performance computing 15 sp2-ltss0.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise high performance computing 15 sp3-ltss0.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise server 15 sp2-ltss0.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise server 15 sp3-ltss0.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise server for sap applications 15 sp20.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise server for sap applications 15 sp30.99.8-150000.3.3.1fixed
Suselibfastjsonenterprise storage 7.10.99.8-150000.3.3.1fixed
Suselibfastjsonlinux enterprise server 12 sp50.99.8-3.6.1fixed
Suselibfastjsonlinux enterprise server for sap applications 12 sp50.99.8-3.6.1fixed
Susejson-clinux enterprise real time 15 sp20.13-3.3.1fixed
Suselibfastjsonlinux enterprise module for basesystem 15 sp40.99.9-150400.3.3.1fixed
Opensuselibfastjsonleap 15.40.99.9-150400.3.3.1fixed
Susejson-copenstack cloud 90.12.1-4.3.1fixed
Susejson-copenstack cloud crowbar 90.12.1-4.3.1fixed
Susejson-clinux enterprise server for sap applications 12 sp40.12.1-4.3.1fixed
Susejson-clinux enterprise software development kit 12 sp50.12.1-4.3.1fixed
Susejson-clinux enterprise server 12 sp2-bcl0.12.1-4.3.1fixed
Susejson-clinux enterprise server 12 sp3-bcl0.12.1-4.3.1fixed
Susejson-clinux enterprise server 12 sp4-ltss0.12.1-4.3.1fixed
Susejson-clinux enterprise server 12 sp50.12.1-4.3.1fixed
Susejson-clinux enterprise server for sap applications 12 sp50.12.1-4.3.1fixed
Opensusejson-cleap 15.30.13-3.3.1fixed
Susejson-clinux enterprise module for basesystem 15 sp30.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15-espos0.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15-ltss0.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15 sp1-espos0.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15 sp1-ltss0.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15 sp2-espos0.13-3.3.1fixed
Susejson-clinux enterprise high performance computing 15 sp2-ltss0.13-3.3.1fixed
Susejson-clinux enterprise server 15-ltss0.13-3.3.1fixed
Susejson-clinux enterprise server 15 sp1-bcl0.13-3.3.1fixed
Susejson-clinux enterprise server 15 sp1-ltss0.13-3.3.1fixed
Susejson-clinux enterprise server 15 sp2-bcl0.13-3.3.1fixed
Susejson-clinux enterprise server 15 sp2-ltss0.13-3.3.1fixed
Susejson-clinux enterprise server for sap applications 150.13-3.3.1fixed
Susejson-clinux enterprise server for sap applications 15 sp10.13-3.3.1fixed
Susejson-clinux enterprise server for sap applications 15 sp20.13-3.3.1fixed
Susejson-cmanager proxy 4.10.13-3.3.1fixed
Susejson-cmanager retail branch server 4.10.13-3.3.1fixed
Susejson-cmanager server 4.10.13-3.3.1fixed
Susejson-clinux enterprise micro 5.00.13-3.3.1fixed
Susejson-clinux enterprise micro 5.10.13-3.3.1fixed
Susejson-centerprise storage 60.13-3.3.1fixed
Susejson-centerprise storage 70.13-3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjson-csourcesid0.13.1+dfsg-8not yet assignedNot reported[960326]
Debianjson-csourceforky0.13.1+dfsg-8not yet assignedNot reported[960326]
Debianjson-csourcetrixie0.13.1+dfsg-8not yet assignedNot reported[960326]
Debianjson-csourcebookworm0.13.1+dfsg-8not yet assignedNot reported[960326]
Debianlibfastjsonsourcesid1.2304.0-1not yet assignedNot reported[1035302]
Debianlibfastjsonsourceforky1.2304.0-1not yet assignedNot reported[1035302]
Debianlibfastjsonsourcetrixie1.2304.0-1not yet assignedNot reported[1035302]
Debianlibfastjsonsourcebookworm1.2304.0-1not yet assignedNot reported[1035302]
Cpejson-ccpeNot reported0.15-20200726Not reportedNVD-CVE-2020-12762Not reported
Alpinejson-capk3.100.13.1-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.110.13.1-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.120.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.130.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.140.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.150.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.160.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.170.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.180.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.190.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.200.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.210.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.220.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.230.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.240.14-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinejson-capk3.90.13.1-r1Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.151.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.161.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.171.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.181.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.191.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.201.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.211.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.221.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.231.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Alpinelibfastjsonapk3.241.2304.0-r0Not reportedALPINE-CVE-2020-12762Not reported
Ubuntujson-cdebpro0.11-3ubuntu1.2+esm3Not reportedUSN-4360-4Not reported
Ubuntujson-cdeb16.040.11-4ubuntu2.6Not reportedUSN-4360-4Not reported
Ubuntujson-cdeb18.040.12.1-1.3ubuntu0.3Not reportedUSN-4360-4Not reported
Ubuntujson-cdeb20.040.13.1+dfsg-7ubuntu0.3Not reportedUSN-4360-4Not reported
Ubuntujson-cdebpro0.11-3ubuntu1.2+esm1Not reportedUSN-4360-1Not reported
Ubuntujson-cdeb16.040.11-4ubuntu2.1Not reportedUSN-4360-1Not reported
Ubuntujson-cdeb18.040.12.1-1.3ubuntu0.1Not reportedUSN-4360-1Not reported
Ubuntujson-cdeb20.040.13.1+dfsg-7ubuntu0.1Not reportedUSN-4360-1Not reported
Ubuntujson-cdebpro0.11-3ubuntu1.2+esm3Not reportedUBUNTU-CVE-2020-12762Not reported
Ubuntujson-cdeb16.040.11-4ubuntu2.6Not reportedUBUNTU-CVE-2020-12762Not reported
Ubuntujson-cdeb18.040.12.1-1.3ubuntu0.3Not reportedUBUNTU-CVE-2020-12762Not reported
Ubuntujson-cdeb20.040.13.1+dfsg-7ubuntu0.3Not reportedUBUNTU-CVE-2020-12762Not reported
Suselibfastjsonrpmlinux enterprise high performance computing 15 sp2-ltss0.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise high performance computing 15 sp3-ltss0.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise server 15 sp2-ltss0.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise server 15 sp3-ltss0.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise server for sap applications 15 sp20.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise server for sap applications 15 sp30.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmenterprise storage 7.10.99.8-150000.3.3.1Not reportedSUSE-SU-2024:1775-1Not reported
Suselibfastjsonrpmlinux enterprise server 12 sp50.99.8-3.6.1Not reportedSUSE-SU-2024:1846-1Not reported
Suselibfastjsonrpmlinux enterprise server for sap applications 12 sp50.99.8-3.6.1Not reportedSUSE-SU-2024:1846-1Not reported
Susejson-crpmlinux enterprise real time 15 sp20.13-3.3.1Not reportedSUSE-SU-2022:0184-2Not reported
Suselibfastjsonrpmlinux enterprise module for basesystem 15 sp40.99.9-150400.3.3.1Not reportedSUSE-SU-2023:2135-1Not reported
Opensuselibfastjsonrpmleap 15.40.99.9-150400.3.3.1Not reportedSUSE-SU-2023:2135-1Not reported
Susejson-crpmopenstack cloud 90.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmopenstack cloud crowbar 90.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server for sap applications 12 sp40.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise software development kit 12 sp50.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server 12 sp2-bcl0.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server 12 sp3-bcl0.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server 12 sp4-ltss0.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server 12 sp50.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Susejson-crpmlinux enterprise server for sap applications 12 sp50.12.1-4.3.1Not reportedSUSE-SU-2022:3001-1Not reported
Opensusejson-crpmleap 15.30.13-3.3.1Not reportedOPENSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise module for basesystem 15 sp30.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15-espos0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15 sp1-espos0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15 sp1-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15 sp2-espos0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise high performance computing 15 sp2-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server 15-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server 15 sp1-bcl0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server 15 sp1-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server 15 sp2-bcl0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server 15 sp2-ltss0.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server for sap applications 150.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server for sap applications 15 sp10.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise server for sap applications 15 sp20.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmmanager proxy 4.10.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmmanager retail branch server 4.10.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmmanager server 4.10.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise micro 5.00.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmlinux enterprise micro 5.10.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmenterprise storage 60.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported
Susejson-crpmenterprise storage 70.13-3.3.1Not reportedSUSE-SU-2022:0184-1Not reported

[Debian bug #960326][Debian bug #1035302]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libfastjson4]Unknown

    Source package: [libfastjson]

    Details (2)
    • 1.2304.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.2304.0-1

      dsa · libfastjson · debian · bookworm

    • 1.2304.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.2304.0-1

      dsa · libfastjson · debian · bookworm

  • Source package: [libfastjson]

    Details (2)
    • 1.2304.0-1 · amd64 · bookworm

      Fixed · Fixed: 1.2304.0-1

      dsa · libfastjson · debian · bookworm

    • 1.2304.0-1 · arm64 · bookworm

      Fixed · Fixed: 1.2304.0-1

      dsa · libfastjson · debian · bookworm

  • [libjson-c5]Unknown

    Source package: [json-c]

    Details (2)
    • 0.16-2 · amd64 · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

    • 0.16-2 · arm64 · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

  • [libjson-c-dev]Unknown

    Source package: [json-c]

    Details (2)
    • 0.16-2 · amd64 · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

    • 0.16-2 · arm64 · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

  • [libjson-c-doc]Unknown

    Source package: [json-c]

    Details (2)
    • 0.16-2 · all · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

    • 0.16-2 · all · bookworm

      Fixed · Fixed: 0.13.1+dfsg-8

      dsa · json-c · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]