256 matches found
CVE-2025-62493 Heap out-of-bounds read in js_bigint_to_string1 in QuickJS
A vulnerability exists in the QuickJS engine's BigInt string conversion logic jsbiginttostring1 due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. The function determines the number of characters ndigits...
CVE-2025-62493
CVE-2025-62493 affects the QuickJS engine, specifically the BigInt string conversion path (js_bigint_to_string1). The root cause is an off-by-one error in the calculation of the number of digits (n_digits) needed for the string representation, which can cause memory reads beyond the allocated Big...
CVE-2025-62493 Heap out-of-bounds read in js_bigint_to_string1 in QuickJS
A vulnerability exists in the QuickJS engine's BigInt string conversion logic jsbiginttostring1 due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. The function determines the number of characters ndigits...
CVE-2025-62496: Integer Overflow or Wraparound
A vulnerability exists in the QuickJS engine's BigInt string parsing logic jsbigintfromstring when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the necessary number of bits nbits required to store the BigInt using the formula:...
QuickJS security vulnerabilities
QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS, which stems from an error in the computation of the median in the BigInt string conversion logic, which could lead to out-of-bounds reads and information disclosure...
QuickJS security vulnerabilities
QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS that stems from an integer overflow in the BigInt string parsing logic, which could result in a heap out-of-bounds write...
PT-2025-42490
Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description An issue exists in the QuickJS engine’s BigInt string conversion logic within the js bigint to string1 function. This is due to an incorrect calculation of the required number of digits,...
PT-2025-42493
Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description A flaw exists in the QuickJS engine’s BigInt string parsing logic within the js bigint from string function when creating a BigInt from a string containing a very large number of digits. The...
EUVD-2021-1916
Malware in sbrugna...
EUVD-2021-1219
Malware in sbrugna...
EUVD-2023-27656
Malicious code in bioql PyPI...
EUVD-2025-12432
Malicious code in bioql PyPI...
EUVD-2022-3638
Malicious code in bioql PyPI...
EUVD-2025-9701
Malicious code in bioql PyPI...
EUVD-2021-33345
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2021-26198
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in JerryScript 2.4.0. There is a SEVG in ecmaderefbigint in ecma-helpers.c file. CVE-2021-26198 Note that Nessus relies on the presence ...
Linux Distros Unpatched Vulnerability : CVE-2025-46688
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quickjs-ng through 0.9.0 has an incorrect size calculation in JSReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is...
mruby:mruby_fuzzer: Stack-use-after-return in udiv
Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5341554870124544 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Stack-use-after-return READ 4 Crash Address: 0x7fc147404084 Crash State...
