GHSA-x4cf-6jr3-3qvp

Source

https://github.com/advisories/GHSA-x4cf-6jr3-3qvp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x4cf-6jr3-3qvp/GHSA-x4cf-6jr3-3qvp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x4cf-6jr3-3qvp

Aliases

CVE-2020-1915

Published

2022-05-24T17:32:10Z

Modified

2023-11-08T04:02:45Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Out-of-bounds Read in Facebook Hermes

Details

An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Database specific

{
    "cwe_ids":  [
        "CWE-125"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-24T01:00:13Z",
    "nvd_published_at":  "2020-10-26T21:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / hermes-engine

Package

Name: hermes-engine; View open source insights on deps.dev
Purl: pkg:npm/hermes-engine

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.2

Database specific

last_known_affected_version_range

"<= 0.7.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x4cf-6jr3-3qvp/GHSA-x4cf-6jr3-3qvp.json"