CVE-2018-11591: Null Pointer Dereference

Q: What is the vulnerability ID and title?

The vulnerability ID is CVE-2018-11591 and the title is Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing.

Q: What is the severity of CVE-2018-11591?

The severity of CVE-2018-11591 is medium with a severity value of 5.5.

Q: How can attackers exploit CVE-2018-11591?

Attackers can exploit CVE-2018-11591 by causing a denial of service (application crash) using a user crafted input file.

Q: How was CVE-2018-11591 addressed?

CVE-2018-11591 was addressed by adding validation for a debug trace print statement in jsvar.c.

Q: Is there any additional information available for CVE-2018-11591?

Yes, you can find additional information for CVE-2018-11591 on the GitHub page of Espruino.

Published May 31, 2018

Updated

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.

Affected Software

1 affected component

Espruino Espruino<1.98

Remediation

Patch Available

https://github.com/espruino/Espruino/commit/b6d362f6a1f2de0b3e7604848116efb509196bf4

Event History

May 31, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the vulnerability ID and title?

The vulnerability ID is CVE-2018-11591 and the title is Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing.

What is the severity of CVE-2018-11591?