CVE-2023-40294-and-CVE-2023-40295

While I was running boron in my environment, I happened to stumble upon 2 heap buffer overflows in libboron libboron.so.2 version 2.0.8 when processing slightly malformed input. This has been officially tested on both Mac x8664 and Linux x8664: Files for reproduction reproduction.zip Compiling...

CVE-2023-40294

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

Heap overflow

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

CVE-2023-40294

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

Boron Buffer Error Vulnerability

Boron is an interpreted, prototype-based scripting language from the personal developer Marc Simpson. A security vulnerability exists in Boron version 2.0.8, which stems from a buffer overflow vulnerability in urparseBlockI...

CVE-2023-40294: Out-of-bounds Write

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

CVE-2023-40294

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...

CVE-2023-40294

libboron in Boron 2.0.8 has a heap-based buffer overflow in urparseBlockI at iparseblk.c...