CVE-2022-22901
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service (DoS) in applications using JerryScript, disrupting system operations.
Recommendation
It is recommended to update JerryScript to a patched version or apply a fix that resolves the assertion error.
Other vulnerabilities in JerryScript
See all- CVE-2017-14749High
JerryScript 1.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .js file. The issue arises from unrecognized \ characters causing incorrect 0x00 characters in bytecode.literal data.
- CVE-2017-9250High
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code.
- CVE-2023-34868High
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.
- CVE-2023-34867High
Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.
Original NVD description (English source)
There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryScript commit a6ab5e9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS