[Bugs] [Bug 13535] New: [CVE 21] hermes 1.3.3 CVEs found

[bugzilla]

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13535

          Platform: 2021.1
            Bug ID: 13535
           Summary: [CVE 21] hermes 1.3.3  CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2020-1914, CVE-2020-1915, CVE-2022-40138,
                    CVE-2023-23556, CVE-2023-23557, CVE-2023-24832,
                    CVE-2023-24833,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: e.kosachev на rosalinux.ru, s.matveev на rosalinux.ru,
                    y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package hermes version 1.3.3

INFO (CVEs are): hermes 1.3.3
 cves found
CVE-2020-1914
Desc: A logic vulnerability when handling the SaveGeneratorLong instruction in
Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows
attackers to potentially read out of bounds or theoretically execute arbitrary
code via crafted JavaScript. Note that this is only exploitable if the
application using Hermes permits evaluation of untrusted JavaScript. Hence,
most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1914
Severity: CRITICAL
CVE-2020-1915
Desc: An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes
prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to
cause a denial of service attack or possible further memory corruption via
crafted JavaScript. Note that this is only exploitable if the application using
Hermes permits evaluation of untrusted JavaScript. Hence, most React Native
applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1915
Severity: HIGH
CVE-2022-40138
Desc: An integer conversion error in Hermes bytecode generation, prior to
commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to
perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note
that this is only exploitable in cases where Hermes is used to execute
untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-40138
Severity: CRITICAL
CVE-2023-23556
Desc: An error in BigInt conversion to Number in Hermes prior to commit
a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious
attacker to execute arbitrary code due to an out-of-bound write. Note that this
bug is only exploitable in cases where Hermes is used to execute untrusted
JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-23556
Severity: CRITICAL
CVE-2023-23557
Desc: An error in Hermes' algorithm for copying objects properties prior to
commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious
attacker to execute arbitrary code via type confusion. Note that this is only
exploitable in cases where Hermes is used to execute untrusted JavaScript.
Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-23557
Severity: CRITICAL
CVE-2023-24832
Desc: A null pointer dereference bug in Hermes prior to commit
5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to
crash an Hermes runtime where the EnableHermesInternal config option was set to
true. Note that this is only exploitable in cases where Hermes is used to
execute untrusted JavaScript. Hence, most React Native applications are not
affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-24832
Severity: HIGH
CVE-2023-24833
Desc: A use-after-free in BigIntPrimitive addition in Hermes prior to commit
a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to
leak raw data from Hermes VM’s heap. Note that this is only exploitable in
cases where Hermes is used to execute untrusted JavaScript. Hence, most React
Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-24833
Severity: HIGH

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено…
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230823/51faa02c/attachment.html>