[ubuntu/noble-updates] jq 1.7.1-3ubuntu0.24.04.1 (Accepted)

[Ubuntu Archive Robot]

jq (1.7.1-3ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow via signed integer limit
    - debian/patches/CVE-2024-23337.patch: fix signed integer overflow in
      jvp_array_write and jvp_object_rehash in src/jv.c, src/jv_aux.c,
      tests/jq.test.
    - CVE-2024-23337
  * SECURITY UPDATE: OOB write via NaN
    - debian/patches/CVE-2024-53427-1.patch: jv_number_value should cache
      the double value of literal numbers in jv.c.
    - debian/patches/CVE-2024-53427-2.patch: reject NaN with payload while
      parsing JSON in src/jv.c, tests/jq.test, tests/shtest.
    - CVE-2024-53427
  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2025-48060-1.patch: improve performance of
      repeating strings in src/builtin.c, src/jv.c, src/jv.h,
      tests/jq.test.
    - debian/patches/CVE-2025-48060-2.patch: fix heap buffer overflow when
      formatting an empty string in src/jv.c, tests/jq.test.
    - CVE-2025-48060

Date: 2025-07-16 16:22:12.684842+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/jq/1.7.1-3ubuntu0.24.04.1
-------------- next part --------------
Sorry, changesfile not available.