GitHub Advisoryadvisory · npm
GHSA-86mr-6m89-vgj3 Buffer Overflow in node-weakauras-parser
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- node-weakauras-parser
- Severity
- Moderate
- Weaknesses
- CWE-120
- Reviewed
- 2020-08-31
Affected packages
• npm node-weakauras-parser: >= 1.0.4, < 1.0.5 → fixed in 1.0.5
• npm node-weakauras-parser: >= 2.0.0, < 2.0.2 → fixed in 2.0.2
• npm node-weakauras-parser: >= 3.0.0, < 3.0.1 → fixed in 3.0.1
Description
Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems.
Recommendation
Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness