CVE-2023-48184: Use After Free
Published Apr 23, 2024
·Updated
Last updated 15 April 2025
Other sources
QuickJS before 7414e5f has a quickjs.h JSFreeValueRT use-after-free because of incorrect garbage collection of async functions with closures.
— NVD
Affected Software
3 affected componentsFixes available
debian/quickjs
2024.01.13-5
QuickJS QuickJS<7414e5f
Quickjs Project Quickjs<2023-12-27
Event History
Apr 23, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
Affected Software
Apr 15, 2025
Data Sourced
via Ubuntu·09:59 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-48184?
CVE-2023-48184 is classified as a high-severity vulnerability due to its potential for use-after-free exploitation.
2
How do I fix CVE-2023-48184?
To fix CVE-2023-48184, you should update QuickJS to version 7414e5f or later, which addresses the garbage collection issue.
3
What impact does CVE-2023-48184 have on applications using QuickJS?
CVE-2023-48184 can lead to code execution vulnerabilities if an attacker exploits the use-after-free condition in applications utilizing QuickJS.
4
Which versions of QuickJS are affected by CVE-2023-48184?
CVE-2023-48184 affects all QuickJS versions prior to 7414e5f.
5
Is CVE-2023-48184 exploitable remotely?
Yes, CVE-2023-48184 can be exploited remotely if the vulnerable application is exposed to untrusted input.