PT-2017-18806 · Samsung · Jerryscript

Jeffjerseycow · Published 2017-05-28 · Updated 2020-10-28 · CVE-2017-9250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JerryScript version 1.0

Description The issue is related to the lexer process char literal function in JerryScript, which does not handle memory allocation for empty strings correctly. This can be exploited by remote attackers using malformed JavaScript source code, leading to a denial of service through a NULL pointer dereference and application crash.

Recommendations For JerryScript version 1.0, consider applying a patch or fix that correctly handles memory allocation for empty strings in the lexer process char literal function to prevent the denial of service.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2017-9250

Affected Products

Jerryscript

References · 6

• 🔥 https://github.com/jerryscript-project/jerryscript/issues/1821 · Exploit
• https://github.com/jerryscript-project/jerryscript/commit/e58f2880df608652aff7fd35c45b242467ec0e79 · Patch
• https://osv.dev/vulnerability/CVE-2017-9250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9250 · Security Note
• https://github.com/zherczeg/jerryscript/commit/03a8c630f015f63268639d3ed3bf82cff6fa77d8 · Note
• http://securitytracker.com/id/1038413 · Note