Struct2Json
Monthly
Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.