The jq utility in Red Hat Enterprise Linux 9.0 contains two security flaws: a signed integer overflow in the jvp_array_write function (CVE-2024-23337) and a stack-buffer-overflow in the jq_fuzz_execute function (jv_string_vfmt) (CVE-2025-48060). Both vulnerabilities could potentially lead to memory corruption issues. Red Hat has issued a security advisory RHSA-2025:10616 describing these issues and providing updated packages to remediate them. The advisory covers multiple architectures supported by Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. No CVSS scores are provided in the advisory, but the severity is rated as moderate. There are no known exploits in the wild at this time.

The identified vulnerabilities in jq could allow an attacker to cause memory corruption through signed integer overflow or stack-buffer-overflow conditions. This may lead to application crashes or potentially other undefined behavior depending on how jq is used. The impact is rated as moderate by Red Hat, indicating a security risk that should be addressed but is not considered critical or high severity. There are no reports of active exploitation in the wild.

Red Hat has released updated jq packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply these updates as soon as possible following the instructions in the Red Hat advisory RHSA-2025:10616 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.