QuickJS-NG heap buffer overflow via Proxy ownKeys enumeration
The QuickJS-NG script engine can crash or be hacked.
Summary
Integer overflows in the QuickJS-NG script engine let an attacker running scripts crash programs or possibly run code. QuickJS-NG versions before 0.16.0 are affected, and 32-bit hosts are most at risk.
Affected when
- 32-bit hosts
- attacker can run scripts
What to do
Update QuickJS-NG to 0.16.0 or later.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen