Gordon Williams

CVE-2018-11594 WRITEUP MEDIUM WRITEUP

Espruino < 1.99 - Denial of Service via Buffer Overflow in jsparse.c VOID Token Parsing

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c.

CVSS 5.5

View Code

CVE-2018-11591 WRITEUP MEDIUM WRITEUP

Espruino < 1.98 - Denial of Service via NULL Pointer Dereference in Syntax Parser

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.

CVSS 5.5

View Code

CVE-2018-11592 WRITEUP MEDIUM WRITEUP

Espruino < 1.98 - Denial of Service via Out-of-bounds Read in Graphics Library

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c.

CVSS 5.5

View Code

CVE-2018-11593 WRITEUP HIGH WRITEUP

Espruino < 1.99 - Denial of Service and Information Disclosure via Buffer Overflow in jslex.c

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c.

CVSS 7.1

View Code

CVE-2018-11590 WRITEUP MEDIUM WRITEUP

Espruino < 1.99 - Denial of Service via Integer Overflow in Syntax Parser

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.

CVSS 5.5

View Code

CVE-2018-11596 WRITEUP MEDIUM WRITEUP

Espruino < 1.99 - Denial of Service via Buffer Overflow in Syntax Parser

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c.

CVSS 5.5

View Code

CVE-2018-11597 WRITEUP MEDIUM WRITEUP

Espruino < 1.99 - Denial of Service via Stack Exhaustion in jsparse.c

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c.

CVSS 5.5

View Code

CVE-2022-25044 WRITEUP HIGH WRITEUP

Espruino 2v11.251 - Stack Buffer Overflow in jsvNewFromString

Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.

CVSS 7.8

View Code