NVD

Id
86487  
Name
CVE-2017-9250  
Description
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-07-18  
Published
2017-05-28  
Modified Date
2017-07-07  
Seq
2017-9250  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
419810 86487 CVE-2017-7946 https://github.com/radare/radare2/commit/d1e8ac62c6d978d4662f69116e30230d43033c92  View
419811 86487 CVE-2017-7946 https://github.com/radare/radare2/issues/7301  View
419812 86487 CVE-2017-7946 https://github.com/radare/radare2/commit/d1e8ac62c6d978d4662f69116e30230d43033c92  View
419813 86487 CVE-2017-7946 https://github.com/radare/radare2/issues/7301  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
68270 JVNDB-2017-004527 JerryScript の jerry-core/parser/js/js-lexer.c の lexer_process_char_literal 関数におけるサービス運用妨害 (DoS) の脆弱性 JerryScript の jerry-core/parser/js/js-lexer.c の lexer_process_char_literal 関数は、空の文字列のメモリ割り当てをスキップしないため、サービス運用妨害 (NULL ポインタデリファレンスおよびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2017-9250 0 CVE-2017-9250 86487 5 7.5 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-004527.html 2017-05-22 2017-06-28 View