CVE-2020-24346

CVE-2020-24346 affects the NGINX-integrated JavaScript engine, specifically njs through 0.4.3. The vulnerability is a use-after-free in function njs_json_parse_iterator_call within njs_json.c. This concrete detail is corroborated by multiple sources in the connected documents (e.g., Red Hat, NVD,...

CVE-2020-24347

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24347

The connected data confirms CVE-2020-24347 affects njs up to version 0.4.3 when used with NGINX, due to an out-of-bounds read in njs_lvlhsh_level_find (njs_lvlhsh.c). Affected component: njs (embedded JavaScript) used in NGINX; root cause is an out-of-bounds read in the hash-level lookup implemen...

CVE-2020-24347

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24348

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

CVE-2020-24348

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

CVE-2020-24348

The CVE-2020-24348 vulnerability is in njs up to version 0.4.3, used in NGINX. It stems from an out-of-bounds read in the njs_json_stringify_iterator function within njs_json.c. The provided sources do not specify affected product versions beyond 0.4.3, nor do they detail the exploit vectors, imp...

CVE-2020-24349

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

CVE-2020-24349

CVE-2020-24349 affects njs up to version 0.4.3 used in NGINX, enabling a control-flow hijack in njs_value_property within njs_value.c. Public sources confirm the issue, with Red Hat and PT-Security entries citing vulnerable versions prior to 0.4.4 and recommending upgrading to 0.4.4+ to resolve. ...

CVE-2020-24347: Out-of-bounds Read

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

PT-2020-15698

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.4.4 Description The issue is an out-of-bounds read in the njs lvlhsh level find function in njs lvlhsh.c. This affects njs, which is used in NGINX. Recommendations For versions prior to 0.4.4, update to version 0.4.4 or...

PT-2020-15697

Name of the Vulnerable Software and Affected Versions njs versions through 0.4.3 Description The issue is related to a use-after-free in the njs json parse iterator call function in njs json.c. This affects njs, which is used in NGINX. Recommendations For versions through 0.4.3, update to a versi...

CVE-2020-24348: Out-of-bounds Read

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

CVE-2020-24346: Use After Free

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

CVE-2020-24349: Use After Free

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

PT-2020-15699

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.4.4 Description The issue is related to an out-of-bounds read in the njs json stringify iterator function in njs json.c. This function is part of the njs component used in NGINX. Recommendations For versions prior to...

njs:njs_process_script_fuzzer: Segv on unknown address in njs_function_frame_free

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5107768305647616 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

njs:njs_process_script_fuzzer: Heap-buffer-overflow in njs_string_new

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=6210873881526272 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x619000002780 Crash...

njs:njs_process_script_fuzzer: Heap-use-after-free in njs_parser_property

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5727429946769408 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x6250000408c0 Crash...

njs:njs_process_script_fuzzer: Use-of-uninitialized-value in njs_string_prototype_split

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5118228753022976 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...