Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package iperf (opens in a new tab)

Threat Intelligence

6.96% (94^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1904-IPERF-666200
published26 Sept 2016
disclosed26 Sept 2016

Report a new vulnerability Found a mistake?

Introduced: 26 Sep 2016

CVE-2016-4303 (opens in a new tab) CWE-119 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:19.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream iperf package and not the iperf package as distributed by Ubuntu.

The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.