CVE-2023-34867
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.
Risk Assessment
Exploitation of this vulnerability may lead to application instability for those using Jerryscript, threatening system integrity.
Recommendation
It is recommended to update Jerryscript to the latest version to mitigate this vulnerability and conduct application testing to identify potential issues.
Other vulnerabilities in Jerryscript 3.0
See all- CVE-2017-14749High
JerryScript 1.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .js file. The issue arises from unrecognized \ characters causing incorrect 0x00 characters in bytecode.literal data.
- CVE-2017-9250High
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code.
- CVE-2023-34868High
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.
- CVE-2022-22901Medium
In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.
Original NVD description (English source)
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base/ecma-property-hashmap.c.