CVE-2021-31875 Memory corruption in n/a
A malicious JSON string triggers a heap buffer overflow in the mJS library, potentially allowing control flow redirection and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-31875?
CVE-2021-31875 is a critical memory corruption vulnerability in n/a, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."
Which versions are affected by CVE-2021-31875?
It affects 1 product.
Products include Cesanta Mongooseos Mjs.
How do I fix CVE-2021-31875?
No fix has been published for CVE-2021-31875 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-31875 being exploited?
There is no known exploitation of CVE-2021-31875 in the wild and no public exploit code.
Sources
Also known as GHSA-gjqw-r32j-j6wq.