CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2023-23556

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Score
9.8 critical
Published
2023-05-18
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
lang/hermeshermes-javascript-engine0.13.0_1unaddressedyuri@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>hermes-javascript-engine</name>
	<range><lt>2023-02-02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An error in BigInt conversion to Number in Hermes prior to commit
	a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a
	malicious attacker to execute arbitrary code due to an out-of-bound
	write. Note that this bug is only exploitable in cases where Hermes is
	used to execute untrusted JavaScript. Hence, most React Native
	applications are not affected.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2023-23556</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-23556</url>
    </references>
    <dates>
      <discovery>2023-05-18</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>