CVE-2024-13903

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada quickjs-ng quickjs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The patch is named 99c02eb45170775a9a679c32b45dd4000ea67aff. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

21 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/quickjs-ng/quickjs/commit/99c02eb45170775a9a679c32b45dd4000ea67aff patch
• https://vuldb.com/?id.300571 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.517394 exploit · advisory pihak ketiga · vdb entry
• https://github.com/quickjs-ng/quickjs/issues/775 exploit · issue tracking
• https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0 release notes
• https://vuldb.com/?ctiid.300571 permissions required · vdb entry