CVE-2017-9250
HighSummary
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code.
Risk Assessment
An attacker can exploit this vulnerability to remotely trigger application crashes, leading to service availability interruptions.
Recommendation
It is recommended to update to the latest version of JerryScript to mitigate this vulnerability and to monitor the application for unauthorized code injection attempts.
Other vulnerabilities in JerryScript 1.0
See all- CVE-2017-14749High
JerryScript 1.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .js file. The issue arises from unrecognized \ characters causing incorrect 0x00 characters in bytecode.literal data.
- CVE-2023-34868High
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.
- CVE-2023-34867High
Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.
- CVE-2022-22901Medium
In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.
Original NVD description (English source)
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.