SB2021012202 - Multiple vulnerabilities in JerryScript

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-29657)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the main_print_unhandled_exception() function in the main-utils.c file. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

2) Out-of-bounds read (CVE-ID: CVE-2020-24344)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a "(function({a=arguments}){const arguments})" buffer over-read. A remote attacker can perform a denial of service attack or read memory contents on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/jerryscript-project/jerryscript/issues/4244
• https://github.com/jerryscript-project/jerryscript/issues/3976