CVE-2017-14749
HighSummary
JerryScript 1.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .js file. The issue arises from unrecognized \ characters causing incorrect 0x00 characters in bytecode.literal data.
Risk Assessment
Attackers may exploit this vulnerability to disrupt application functionality or execute malicious code, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update to the latest version of JerryScript to mitigate this vulnerability and to monitor applications for suspicious .js files.
Other vulnerabilities in JerryScript 1.0
See all- CVE-2017-9250High
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code.
- CVE-2023-34868High
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.
- CVE-2023-34867High
Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.
- CVE-2022-22901Medium
In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.
Original NVD description (English source)
JerryScript 1.0 allows remote attackers to cause a denial of service (jmem_heap_alloc_block_internal heap memory corruption) or possibly execute arbitrary code via a crafted .js file, because unrecognized \ characters cause incorrect 0x00 characters in bytecode.literal data.