PT-2020-13902 · Jerryscript · Jerryscript

Nszetei · Published 2020-06-15 · Updated 2021-07-21 · CVE-2020-14163

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0

Description An issue was discovered in ecma/operations/ecma-container-object.c where operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation. This is demonstrated by improper read access to memory in ecma gc set object visited in ecma/base/ecma-gc.c.

Recommendations For JerryScript version 2.2.0, as a temporary workaround, consider restricting access to the ecma gc set object visited function in ecma/base/ecma-gc.c until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-14163

Affected Products

Jerryscript

References · 5

• https://github.com/jerryscript-project/jerryscript/commit/c2b662170245a16f46ce02eae68815c325d99821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14163 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14163 · Vendor Advisory
• https://github.com/jerryscript-project/jerryscript/issues/3804 · Note
• https://t.me/cvenotify/4398 · Telegram Post