CVE-2015-4590 | BDVDB-2026-70041 Detail

Description#

The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/bblanchon/ArduinoJson/commit/5e7b9ec688d79e7b16ec7064e1d37e8481a31e72
https://github.com/bblanchon/ArduinoJson/pull/81
http://www.openwall.com/lists/oss-security/2015/06/16/6
https://github.com/bblanchon/ArduinoJson/blob/master/CHANGELOG.md
http://www.securityfocus.com/bid/75150

Exploit#

No public exploit known

History#

Version 12015-06-22Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.