6.5

CVE-2020-8244

Exploit
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bufferlist Project ≫ Bufferlist SwPlatformnode.js Version < 1.2.3
Bufferlist Project ≫ Bufferlist SwPlatformnode.js Version >= 2.0.0 < 2.2.1
Bufferlist Project ≫ Bufferlist SwPlatformnode.js Version >= 3.0.0 < 3.0.1
Bufferlist Project ≫ Bufferlist SwPlatformnode.js Version >= 4.0.0 < 4.0.3
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.58
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:N/A:P
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-126 Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

https://hackerone.com/reports/966347
Patch
Third Party Advisory
Exploit