Critical Stack-Based Buffer Overflow in QuickJS Package
Summary
UBUNTU-CVE-2024-13903: A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Affects quickjs versions 2021.03.27-1 – 2024.01.13-5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight JavaScript engine that is designed for embedding in applications. It supports modern JavaScript features and is known for its small footprint and fast execution. However, a vulnerability has been identified in versions up to 0.8.0 that could lead to severe security issues if exploited.
Vulnerability Detail
A vulnerability has been discovered in the QuickJS package, specifically in the function JS_GetRuntime within the quickjs.c file. This vulnerability allows for a stack-based buffer overflow, which can be exploited remotely. If an attacker successfully exploits this vulnerability, they could potentially execute arbitrary code, leading to a complete compromise of the affected system. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately possible, consider restricting access to the affected application to trusted users only. This may help mitigate the risk of exploitation until the package can be updated.
Conclusion
The QuickJS package has a critical vulnerability that can lead to severe security risks if not addressed. It is crucial to upgrade to the patched version to protect your systems from potential exploitation. Additionally, utilizing tools like Vulert can help you stay informed about vulnerabilities in your software.
See every vulnerability recorded for quickjs →
FAQ
The vulnerability is a stack-based buffer overflow in the QuickJS package, which can be exploited remotely.
Exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, leading to a complete compromise.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can monitor your open-source dependencies using tools like Vulert, which alerts you in real-time for vulnerabilities based on your manifest file.
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
