CVE-2023-34868
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.
Risk Assessment
This issue may lead to unexpected application behavior, potentially affecting the stability and security of the system.
Recommendation
It is recommended to update Jerryscript to the latest version to mitigate this vulnerability.
Other vulnerabilities in Jerryscript 3.0
See all- CVE-2017-14749High
JerryScript 1.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .js file. The issue arises from unrecognized \ characters causing incorrect 0x00 characters in bytecode.literal data.
- CVE-2017-9250High
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code.
- CVE-2023-34867High
Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.
- CVE-2022-22901Medium
In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.
Original NVD description (English source)
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-statm.c.