CVE-2022-25872 - Out-of-bounds Read

Back Back to CVE browser

MEDIUM

Out-of-bounds Read

Published Jun 17, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 1.12%

Description

All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory.

Affected products

Vendor n/a Product Fast-String-Search Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Fast-String-Search

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
npm	fast-string-search	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6069
Advisory
https://github.com/advisories/GHSA-hmqg-p8f8-3qrw
Advisory
https://github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192
x_refsource_MISCBroken LinkThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25872
https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6069		Advisory
https://github.com/advisories/GHSA-hmqg-p8f8-3qrw		Advisory
https://github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192		x_refsource_MISCBroken LinkThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25872
https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368		x_refsource_MISCExploitThird Party Advisory