CVE-2023-23557

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScrip...

CVE-2023-23556

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted...

CVE-2023-23556

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted...

CVE-2023-23556

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted...

CVE-2023-23556

CVE-2023-23556 affects the Facebook Hermes JavaScript engine. A bug in BigInt conversion to Number exists in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80, allowing a malicious actor to execute arbitrary code via an out-of-bounds write when untrusted JavaScript is executed. The ...

CVE-2023-23556

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted...

Facebook Hermes 安全漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browser & Node.js. Facebook Hermes has a security...

PT-2023-19038 · Hermes · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes affected versions not specified Description: An error in Hermes' algorithm for copying objects properties could be used by a malicious attacker to execute arbitrary code via type confusion. This issue is only exploitable in cases where...

Facebook Hermes 代码问题漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes has a security...

Facebook Hermes 缓冲区错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native apps to improve the performance of mobile client apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes a6dcafe6ded8e61658b40f5699878cd19a481f8...

PT-2023-19037 · Facebook · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes versions prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 Description: An error in BigInt conversion to Number in Hermes could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. This...

Facebook Hermes 资源管理错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes suffers from a...

PT-2023-19812 · Hermes · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes versions prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 Description: A null pointer dereference bug could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true...

PT-2023-22710 · Hermes · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes versions prior to commit da8990f737ebb9d9810633502f65ed462b819c09 Description: A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled could have been used by an attacker to achieve remot...

PT-2023-19813 · Facebook · Hermes

Name of the Vulnerable Software and Affected Versions: Hermes versions prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 Description: A use-after-free in BigIntPrimitive addition could have been used by an attacker to leak raw data from Hermes VM’s heap. This issue is only exploitable in...

Facebook Hermes 安全漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client apps, but is not applicable to server-side infrastructures such as browsers & Node.js. Facebook Hermes...

Facebook Hermes 资源管理错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes has a security...

PT-2023-20367 · Hermes +1 · Hermes +2

Name of the Vulnerable Software and Affected Versions: TypedArray versions prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 Description: A type confusion bug in TypedArray could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. This is only...

Facebook Hermes 资源管理错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. A security vulnerability exists in...

CVE-2022-23507 Light client verification not taking into account chain ID

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...