PkgSeer

Vulnerability GHSA-9cv5-4wqv-9w94

High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
November 01, 2022 at 12:00 PM UTC
muhammara and hummus vulnerable to denial of service by NULL pointer dereference
<1.0.111
<1.0.111

Summary

muhammara and hummus vulnerable to denial of service by NULL pointer dereference

Details

Impact

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

Patches

It has been patched in 3.1.1 and has been backported to 2.6.1 Hummus has a patch in 1.0.111.

Workarounds

Do not process files from untrusted sources or update.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25892 https://github.com/galkahana/HummusJS/issues/463 https://github.com/julianhille/MuhammaraJS/issues/214 https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002 https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51 https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138 https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
4 months ago
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
1.0.1 - 6.0.4 GHSA-fhp4-pr5j-46m5
1.0.1 - 6.0.4 GHSA-fhp4-pr5j-46m5
High Risk
3 years ago
muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
1.0.1 - 2.6.1 and 3.0.0 - 3.3.0 GHSA-2r7v-cmch-5x26
1.0.1 - 2.6.1 and 3.0.0 - 3.3.0 GHSA-2r7v-cmch-5x26
High Risk
3 years ago
muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
1.0.1 - 2.6.1 and 3.0.0 - 3.3.0 GHSA-2r7v-cmch-5x26
1.0.1 - 2.6.1 and 3.0.0 - 3.3.0 GHSA-2r7v-cmch-5x26
High Risk
4 years ago
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
1.0.1 - 2.5.0 GHSA-rcrx-fpjp-mfrw
1.0.1 - 2.5.0 GHSA-rcrx-fpjp-mfrw
High Risk
4 years ago
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
1.0.1 - 2.5.0 GHSA-rcrx-fpjp-mfrw
1.0.1 - 2.5.0 GHSA-rcrx-fpjp-mfrw
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 years ago
November 01, 2022 at 12:00 PM UTC
Fixed (3.1.1)
4 years ago
October 24, 2022 at 07:14 AM UTC
Fixed (2.6.1)
4 years ago
October 24, 2022 at 08:35 AM UTC
Fixed (1.0.111)
4 years ago
November 02, 2022 at 03:13 PM UTC
Last Modified
3 years ago
November 08, 2023 at 04:08 AM UTC