CVE-2022-39381
02.11.2022, 15:15
Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.Enginsight
| Vendor | Product | Version |
|---|---|---|
| muhammarajs_project | muhammarajs | 𝑥 ≤ 2.6.0 |
| pdfhummus | hummusjs | 𝑥 < 1.0.111 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-690 - Unchecked Return Value to NULL Pointer DereferenceThe product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
- CWE-476 - NULL Pointer DereferenceA NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
References