Description
A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function js_iterator_concat_return of the file quickjs.c. This manipulation causes use after free. The attack requires local access. The exploit has been published and may be used. Patch name: daab4ad4bae4ef071ed0294618d6244e92def4cd. Applying a patch is the recommended action to fix this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
quickjs-ng quickjs
0.12.0affected0.12.1affected
References
- https://vuldb.com/?id.350414 ↗
- https://vuldb.com/?ctiid.350414 ↗
- https://vuldb.com/?submit.769600 ↗
- https://github.com/quickjs-ng/quickjs/issues/1368 ↗
- https://github.com/quickjs-ng/quickjs/pull/1370 ↗
- https://github.com/quickjs-ng/quickjs/issues/1368#issue-4004680962 ↗
- https://github.com/quickjs-ng/quickjs/commit/daab4ad4bae4ef071ed0294618d6244e92def4cd ↗
- https://github.com/quickjs-ng/quickjs/ ↗