PT-2017-18806 · Samsung · Jerryscript

Jeffjerseycow · Publicado 2017-05-28 · Atualizado 2020-10-28 · CVE-2017-9250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JerryScript version 1.0

Description The issue is related to the lexer process char literal function in JerryScript, which does not handle memory allocation for empty strings correctly. This can be exploited by remote attackers using malformed JavaScript source code, leading to a denial of service through a NULL pointer dereference and application crash.

Recommendations For JerryScript version 1.0, consider applying a patch or fix that correctly handles memory allocation for empty strings in the lexer process char literal function to prevent the denial of service.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2017-9250

Produtos afetados

Jerryscript

Referências · 6

• 🔥 https://github.com/jerryscript-project/jerryscript/issues/1821 · Exploit
• https://github.com/jerryscript-project/jerryscript/commit/e58f2880df608652aff7fd35c45b242467ec0e79 · Correção
• https://github.com/zherczeg/jerryscript/commit/03a8c630f015f63268639d3ed3bf82cff6fa77d8 · Nota
• http://securitytracker.com/id/1038413 · Nota
• https://osv.dev/vulnerability/CVE-2017-9250 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9250 · Nota de Segurança