Lucene search

GitHub Advisory DatabaseGHSA-XGMM-3VVR-6C8J

HistorySep 05, 2023 - 6:30 a.m.

Index out of bounds leading to crash

2023-09-0506:30:14

CWE-129

GitHub Advisory Database

github.com

index out of bounds

zplgfa 1.1.1

converttographicfield

security consequence

image of zero width

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence

Affected configurations

Vulners

Node

simonwaldherrzplgfaRange≤1.1.1go

CPENameOperatorVersion
simonwaldherr.de/go/zplgfale1.1.1

CPE	Name	Operator	Version
	simonwaldherr.de/go/zplgfa	le	1.1.1

References

github.com/advisories/GHSA-xgmm-3vvr-6c8j

github.com/SimonWaldherr/zplgfa/commit/c0d018ffa921cd2460b80f766b7969fbe63678fc

github.com/SimonWaldherr/zplgfa/pull/6

nvd.nist.gov/vuln/detail/CVE-2023-36307

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for GHSA-XGMM-3VVR-6C8J