CVE-2018-1000636 Null dereference in n/a

Medium 6.5 Published 20 Aug 2018 Updated 17 Sep 2024

A null pointer dereference in JerryScript allows attackers to cause a denial of service via specially crafted JavaScript code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-1000636?

CVE-2018-1000636 is a medium-severity vulnerability in Jerryscript Jerryscript, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

JerryScript version Tested on commit f86d7459d195c8ba58479d1861b0cc726c8b3793. Analysing history it seems that the issue has been present since commit 64a340ffeb8809b2b66bbe32fd443a8b79fdd860 contains a CWE-476: NULL Pointer Dereference vulnerability in Triggering undefined behavior at jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c:598 (passing NULL to memcpy as 2nd argument) results in null pointer dereference (segfault) at jerry-core/jmem/jmem-heap.c:463 that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute specially crafted javascript code. This vulnerability appears to have been fixed in after commit 87897849f6879df10e8ad68a41bf8cf507edf710.

Weakness: CWE-476

Which versions are affected by CVE-2018-1000636?

It affects 1 product.

Products include Jerryscript Jerryscript.

How do I fix CVE-2018-1000636?

No fix has been published for CVE-2018-1000636 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1000636 being exploited?

There is no known exploitation of CVE-2018-1000636 in the wild and no public exploit code.

All Jerryscript Jerryscript vulnerabilities

Sources

Also known as GHSA-qcmj-vf57-9376, UBUNTU-CVE-2018-1000636.