The vulnerabilities of the functions function#copy and function#toStringTokens in ECMAScript 5 from the es5-ext package allow a attacker to cause a service failure.

🗓️ 12 Sep 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Vulnerabilities in functions copy and toStringTokens of ECMAScript five es5-ext cause resource abuse.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	28 Mar 202419:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management	12 Dec 202515:25	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	3 May 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana for Synthetic PoP is affected by Multiple Security Vulnerabilities	18 Apr 202413:43	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	22 Jul 202414:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in es5-ext-0.10.53.tgz	20 Sep 202421:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in medikoo es5-ext	26 Feb 202518:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (January 2025)	3 Apr 202523:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in medikoo es5-ext and Node.js packages might affect IBM Storage Defender – Resiliency Service (CVE-2024-27088 and CVE-2024-28849)	5 Apr 202417:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	26 Aug 202414:16	–	ibm

Source	Link
github	www.github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
github	www.github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
github	www.github.com/medikoo/es5-ext/issues/201
github	www.github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

06 Feb 2025 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 34.4

EPSS0.00535

ecmascript five copy function toStringTokens function resource abuse vulnerability