PT-2020-15698

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.4.4 Description The issue is an out-of-bounds read in the njs lvlhsh level find function in njs lvlhsh.c. This affects njs, which is used in NGINX. Recommendations For versions prior to 0.4.4, update to version 0.4.4 or...

CVE-2020-24347: Out-of-bounds Read

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24348: Out-of-bounds Read

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

PT-2020-15699

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.4.4 Description The issue is related to an out-of-bounds read in the njs json stringify iterator function in njs json.c. This function is part of the njs component used in NGINX. Recommendations For versions prior to...

CVE-2020-24349: Use After Free

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

PT-2020-15697

Name of the Vulnerable Software and Affected Versions njs versions through 0.4.3 Description The issue is related to a use-after-free in the njs json parse iterator call function in njs json.c. This affects njs, which is used in NGINX. Recommendations For versions through 0.4.3, update to a versi...

CVE-2020-24346: Use After Free

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

njs:njs_process_script_fuzzer: Segv on unknown address in njs_function_frame_free

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5107768305647616 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

njs:njs_process_script_fuzzer: Heap-buffer-overflow in njs_string_new

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=6210873881526272 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x619000002780 Crash...

njs:njs_process_script_fuzzer: Heap-use-after-free in njs_parser_property

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5727429946769408 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x6250000408c0 Crash...

njs:njs_process_script_fuzzer: Use-of-uninitialized-value in njs_string_prototype_split

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5118228753022976 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

njs:njs_process_script_fuzzer: Bad-cast to njs_value_t' (aka 'union njs_value_s')njs_vmcode_interpreter in njs_function_lambda_call

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=4779964628205568 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerubsannjs Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000002b16660 Crash State: Bad-cast t...

njs:njs_process_script_fuzzer: Use-of-uninitialized-value in njs_vsprintf

Detailed Report: https://oss-fuzz.com/testcase?key=5124165974884352 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: njsvsprintf njserrorfmtnew...

njs:njs_process_script_fuzzer: Heap-buffer-overflow in njs_string_prototype_split

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5647502740291584 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x625000048100 Crash...

NGINX NJS Heap-Based Buffer Overflow (CVE-2019-12206)

A buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

NGINX NJS Heap-Based Buffer Overflow (CVE-2019-12207)

A heap-based buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

NGINX NJS Heap-Based Buffer Overflow (CVE-2019-12208)

A buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

NGINX NJS Heap-Based Buffer Overflow (CVE-2019-11838)

A buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

NGINX NJS Buffer Overflow (CVE-2019-13067)

A buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

NGINX NJS Heap-Based Buffer Overflow (CVE-2019-11839)

A buffer overflow vulnerability exists in NGINX NJS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...