Buffer Overflow in node-weakauras-parser
Summary
GHSA-86mr-6m89-vgj3: Buffer Overflow in node-weakauras-parser. Affects node-weakauras-parser across 3 version ranges.
>= 1.0.4, < 1.0.5
>= 2.0.0, < 2.0.2
>= 3.0.0, < 3.0.1
Fixed in 1.0.5, 2.0.2 or 3.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-weakauras-parser package is an npm package used for parsing weakauras, which are custom user interfaces for the World of Warcraft game. It allows users to create and customize their own UI elements. However, this package is vulnerable to a Buffer Overflow issue.
Vulnerability Detail
The vulnerability in node-weakauras-parser is due to the encode_weakaura function failing to properly validate the input size. This allows an attacker to provide a buffer of 13835058055282163711 bytes, causing an overflow on 64-bit systems. This can lead to a crash or potentially allow an attacker to execute arbitrary code on the affected system. The vulnerability has been assigned a severity level of MODERATE and is classified under CWE-120.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.4, < 1.0.51.0.5npm install node-weakauras-parser@1.0.5 -
>= 2.0.0, < 2.0.22.0.2npm install node-weakauras-parser@2.0.2 -
>= 3.0.0, < 3.0.13.0.1npm install node-weakauras-parser@3.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the package as mentioned above.
Conclusion
In conclusion, the node-weakauras-parser package is vulnerable to a Buffer Overflow issue. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-weakauras-parser →
FAQ
node-weakauras-parser is an npm package used for parsing weakauras, which are custom user interfaces for the World of Warcraft game.
A Buffer Overflow is a vulnerability that occurs when a program tries to write more data to a buffer than it can hold, causing the excess data to overflow into adjacent memory locations.
The vulnerability can lead to a crash of the affected system or potentially allow an attacker to execute arbitrary code.
The vulnerability has been assigned a severity level of MODERATE.
To fix this vulnerability, it is recommended to upgrade to versions 1.0.5, 2.0.2, 3.0.1, or later of node-weakauras-parser.
