VulnerabilityModified
CVE-2019-1010176
JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow.
CRITICAL 9.8EPSS 2.55%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:377). The attack vector is: executing crafted javascript code. The fixed version is: after commit 505dace719aebb3308a3af223cfaa985159efae0.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.55% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- jerryscript/jerryscript
- Source
- josh@bress.net
References
- https://github.com/jerryscript-project/jerryscript/issues/2476Exploit, Patch, Third Party Advisory
- https://github.com/jerryscript-project/jerryscript/issues/2476Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.