CVE-2020-1913
09.09.2020, 19:15
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.Enginsight
| Vendor | Product | Version |
|---|---|---|
| hermes | 𝑥 ≤ 0.4.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-195 - Signed to Unsigned Conversion ErrorThe software uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
- CWE-681 - Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.