PT-2025-12398 · Quickjs+1 · Quickjs+1

Haoxin Tu · Published 2025-03-21 · Updated 2025-03-21 · CVE-2024-13903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions QuickJS versions up to 0.8.0

Description A stack-based buffer overflow issue was found in the JS GetRuntime function of the quickjs.c file in the qjs component. This issue can be exploited remotely, leading to a buffer overflow on the stack. The problem is declared as problematic. Upgrading to version 0.9.0 can address this issue.

Recommendations For QuickJS versions up to 0.8.0, upgrade to version 0.9.0 to address the issue. As a temporary workaround, consider restricting access to the JS GetRuntime function until the patch is applied.

Exploit

Fix

Memory Corruption

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-121

CWE-119

Related Identifiers

CVE-2024-13903

Affected Products

Debian

Quickjs

References · 18

• 🔥 https://github.com/quickjs-ng/quickjs/issues/775 · Exploit
• 🔥 https://vuldb.com/?submit.517394 · Exploit
• https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0 · Patch
• https://github.com/quickjs-ng/quickjs/commit/99c02eb45170775a9a679c32b45dd4000ea67aff · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-13903 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-13903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13903 · Security Note
• https://ubuntu.com/security/CVE-2024-13903 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-13903 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13903 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-13903 · Vendor Advisory
• https://t.me/cvetracker/19595 · Telegram Post
• https://t.me/cvedetector/20799 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1903088393724236047 · Twitter Post
• https://twitter.com/CVEnew/status/1902988273359728813 · Twitter Post