Design/Logic Flaw

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...

CVE-2020-1913

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes...

CVE-2020-1913

The CVE-2020-1913 issue affects Facebook Hermes’ JavaScript interpreter and is caused by an Integer signedness error. A crafted JavaScript payload can cause denial of service or potentially remote code execution if untrusted JS is evaluated by the Hermes runtime. The description notes that most R...

CVE-2020-1912

CVE-2020-1912 affects Facebook Hermes, a JavaScript VM used in React Native. The vulnerability is an out-of-bounds read/write when executing lazily compiled inner generator functions, prior to commit 091835377369c8fd5917d9b87acffa721ad2a168. Exploitation requires the application to evaluate untru...

CVE-2020-1912

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...

hermes-e-mailing.com Cross Site Scripting vulnerability OBB-1312548

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-1911

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

CVE-2020-1911

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

Type confusion

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

CVE-2020-1911

CVE-2020-1911 concerns a type confusion in Facebook Hermes when resolving properties of JavaScript objects with specially-crafted prototype chains, prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da. The vulnerability could allow arbitrary code execution if untrusted JavaScript is evaluated...

CVE-2020-1911

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

OSV-2020-893 Heap-buffer-overflow in hermes::parser::JSLexer::consumeBracedCodePoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23725 Crash type: Heap-buffer-overflow READ 1 Crash state: hermes::parser::JSLexer::consumeBracedCodePoint hermes::parser::JSLexer::consumeUnicodeEscape hermes::parser::JSLexer::advance...

hermes-schleifwerkzeuge.com Cross Site Scripting vulnerability OBB-1229505

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

hermes:fuzzer-jsi-entry: Heap-buffer-overflow in hermes::parser::JSLexer::consumeBracedCodePoint

Project: https://github.com/facebook/hermes.git Detailed Report: https://oss-fuzz.com/testcase?key=5068829519773696 Project: hermes Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-jsi-entry Job Type: libfuzzerasanhermes Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Threat spotlight: the curious case of Ryuk ransomware

Ryuk. A name once unique to a fictional character in a popular Japanese comic book and cartoon series is now a name that appears in several rosters of the nastiest ransomware to ever grace the wild web. For an incredibly young strain—only 15 months old—Ryuk ransomware gaining such notoriety is...

Ryuk Hauls in $3.7M in 'Earnings,' Adds TrickBot to the Attack Mix

The Ryuk ransomware has raked in $3.7 million in bitcoin payments since it first appeared last August, researchers say – and has emerged as the calling card for a crime organization called Grim Spider a.k.a. MixMaster. It turns out that Grim Spider could share a link with other crime syndicates,...

Ryuk Ransomware Attack: Rush to Attribution Misses the Point

ARCHIVED STORY Ryuk Ransomware Attack: Rush to Attribution Misses the Point By John Fokker · January 09, 2019 Senior analyst Ryan Sherstobitoff contributed to this report. During the past week, an outbreak of Ryuk ransomware that impeded newspaper printing services in the United States has garner...

Ryuk Ransomware Attack: Rush to Attribution Misses the Point

ARCHIVED STORY Ryuk Ransomware Attack: Rush to Attribution Misses the Point By John Fokker · January 09, 2019 Senior analyst Ryan Sherstobitoff contributed to this report. During the past week, an outbreak of Ryuk ransomware that impeded newspaper printing services in the United States has garner...

Ryuk ransomware attacks businesses over the holidays

While families gathered for food and merriment on Christmas Eve, most businesses slumbered. Nothing was stirring, not even a mouse—or so they thought. For those at Tribune Publishing and Data Resolution, however, a silent attack was slowly spreading through their networks, encrypting data and...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...