CVE-2025-46687

Опубликовано: 27 апр. 2025

Источник: nvd

CVSS3: 5.6

CVSS3: 7.8

EPSS Низкий

Описание

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Ссылки

https://bellard.org/quickjs/Changelog
Release Notes
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
Patch
https://github.com/bellard/quickjs/issues/399
Exploit
Issue Tracking
Vendor Advisory
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
Patch
https://github.com/quickjs-ng/quickjs/issues/1018
Exploit
Issue Tracking
Vendor Advisory
https://github.com/quickjs-ng/quickjs/pull/1020
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:bellard:quickjs:*:*:*:*:*:*:*:*

Версия до 2025-04-26 (исключая)

cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:*

Версия до 0.9.0 (включая)

EPSS

Процентиль: 10%

0.00035

Низкий

5.6 Medium

CVSS3

7.8 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

CVE-2025-46687

CVSS3: 5.6

ubuntu

10 месяцев назад

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

CVE-2025-46687

CVSS3: 5.6

debian

10 месяцев назад

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString f ...

GHSA-hrc5-3jpv-g9x2

CVSS3: 5.6

github

10 месяцев назад

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

EPSS

Процентиль: 10%

0.00035

Низкий

5.6 Medium

CVSS3

7.8 High

CVSS3

Дефекты

CWE-770