CVE-2018-11419 Memory corruption in n/a
A heap-based buffer over-read in JerryScript allows attackers to cause denial of service or disclose memory via crafted regular expressions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11419?
CVE-2018-11419 is a critical memory corruption vulnerability in Jerryscript Jerryscript, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function via a RegExp("[\\u0") payload, related to re_parse_char_class in parser/regexp/re-parser.c.
Weakness: CWE-125
Which versions are affected by CVE-2018-11419?
It affects 1 product.
Products include Jerryscript Jerryscript.
How do I fix CVE-2018-11419?
No fix has been published for CVE-2018-11419 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-11419 being exploited?
There is no known exploitation of CVE-2018-11419 in the wild and no public exploit code.
Other vulnerabilities in Jerryscript Jerryscript
Sources
Also known as GHSA-3f65-pmph-3762, UBUNTU-CVE-2018-11419.