GitHub Advisoryadvisory · npm

GHSA-86mr-6m89-vgj3 Buffer Overflow in node-weakauras-parser

MEDIUM Published 2020-09-03 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
node-weakauras-parser
Severity
Moderate
Weaknesses
CWE-120
Reviewed
2020-08-31

Affected packages

• npm node-weakauras-parser: >= 1.0.4, < 1.0.5 → fixed in 1.0.5 • npm node-weakauras-parser: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • npm node-weakauras-parser: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems. Recommendation Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References