CVE-2020-12762 @ morris

"CVE-2020-12762"
"json-c-0.11-4.el7_0"
"Am I vulnerable?"

Status

new

Priority

7.8

Match score

4.0

Risk

MemCorrupt

CVSS

7.8 HIGH

Reason

cpe: json-c; pkgs: json-c; version: in-range: json-c-0.11-4.el7_0; risk:memory_corruption

Created

2026-10-15T10:20:43Z

Updated

2026-10-20T10:18:51Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
json-c-0.11-4.el7_0

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: json-c

System	Matches	Ticket for CVE-2020-12762
morris	json-c 0.11	new open
mufasa	json-c 0.11	new open
Archive	libjson-c3 0.12.1+ds-2+deb10u1	none
Bullseye	libjson-c5 0.15-2+deb11u1	none
Helios	libjson-c5 0.15-2+deb11u1	none
Janus	libjson-c3 0.12.1+ds-2+deb10u1	none
Library	libjson-c2 0.11-4	none
Matrix	libjson-c5 0.16-2	none
Saiph	libjson-c2 0.11-4; libjson-c3 0.12.1+ds-2+deb10u1	none
Silk	libjson-c5 0.16-2	none

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
mufasa	new	7.8	2026-10-20T10:18:51Z	Open

Description

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.

Update status

Add note only

References

NVD: CVE-2020-12762