UbuntuUpdates.org

Package "jq"

Name: jq

Description:

lightweight and flexible command-line JSON processor
Latest version: 1.7.1-3ubuntu1.1
Release: plucky (25.04)
Level: updates
Repository: main
Homepage: https://jqlang.github.io/jq

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "jq"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "jq" in Plucky

Repository Area Version
base main 1.7.1-3ubuntu1
security main 1.7.1-3ubuntu1.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.7.1-3ubuntu1.1 2025-07-21 17:20:10 UTC

  jq (1.7.1-3ubuntu1.1) plucky-security; urgency=medium

  * SECURITY UPDATE: integer overflow via signed integer limit
    - debian/patches/CVE-2024-23337.patch: fix signed integer overflow in
      jvp_array_write and jvp_object_rehash in src/jv.c, src/jv_aux.c,
      tests/jq.test.
    - CVE-2024-23337
  * SECURITY UPDATE: OOB write via NaN
    - debian/patches/CVE-2024-53427-1.patch: jv_number_value should cache
      the double value of literal numbers in jv.c.
    - debian/patches/CVE-2024-53427-2.patch: reject NaN with payload while
      parsing JSON in src/jv.c, tests/jq.test, tests/shtest.
    - CVE-2024-53427
  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2025-48060-1.patch: improve performance of
      repeating strings in src/builtin.c, src/jv.c, src/jv.h,
      tests/jq.test.
    - debian/patches/CVE-2025-48060-2.patch: fix heap buffer overflow when
      formatting an empty string in src/jv.c, tests/jq.test.
    - CVE-2025-48060

 -- Marc Deslauriers <email address hidden> Wed, 16 Jul 2025 07:30:49 -0400
CVE-2024-23337 jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483
CVE-2024-53427 decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buf
CVE-2025-48060 jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_


About   -   Send Feedback to @ubuntu_updates