diff --git a/advisories/github-reviewed/2025/03/GHSA-9m3q-rhmv-5q44/GHSA-9m3q-rhmv-5q44.json b/advisories/github-reviewed/2025/03/GHSA-9m3q-rhmv-5q44/GHSA-9m3q-rhmv-5q44.json new file mode 100644 index 00000000000..f2b0939d499 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-9m3q-rhmv-5q44/GHSA-9m3q-rhmv-5q44.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9m3q-rhmv-5q44", + "modified": "2025-03-12T15:35:23Z", + "published": "2025-03-12T15:35:23Z", + "aliases": [ + "CVE-2025-27788" + ], + "summary": "Out-of-bounds Read in Ruby JSON Parser ", + "details": "### Impact\n\nA specially crafted document could cause an out of bound read, most likely resulting in a crash.\n\nVersions 2.10.0 and 2.10.1 are impacted. Older versions are not.\n\n### Patches\n\nVersion 2.10.2 fixes the problem.\n\n### Workarounds\n\nNone.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "json" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.10.0" + }, + { + "fixed": "2.10.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.10.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27788" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ruby/json" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/json/releases/tag/v2.10.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T15:35:23Z", + "nvd_published_at": "2025-03-12T14:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json b/advisories/github-reviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json new file mode 100644 index 00000000000..a13228ae097 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v2mw-5mch-w8c5", + "modified": "2025-03-12T15:33:44Z", + "published": "2025-03-10T18:31:56Z", + "aliases": [ + "CVE-2025-25977" + ], + "summary": "canvg Prototype Pollution vulnerability", + "details": "An issue in canvg v.4.0.2 can lead to prototype pollution via the Constructor of the class StyleElement.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "canvg" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25977" + }, + { + "type": "WEB", + "url": "https://github.com/canvg/canvg/issues/1749" + }, + { + "type": "PACKAGE", + "url": "https://github.com/canvg/canvg" + }, + { + "type": "WEB", + "url": "https://github.com/canvg/canvg/blob/937668eced93e0335c67a255d0d2277ea708b2cb/src/Document/StyleElement.ts" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T15:33:44Z", + "nvd_published_at": "2025-03-10T16:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json b/advisories/unreviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json deleted file mode 100644 index 250ad19abf9..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-v2mw-5mch-w8c5/GHSA-v2mw-5mch-w8c5.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v2mw-5mch-w8c5", - "modified": "2025-03-10T18:31:56Z", - "published": "2025-03-10T18:31:56Z", - "aliases": [ - "CVE-2025-25977" - ], - "details": "An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25977" - }, - { - "type": "WEB", - "url": "https://github.com/canvg/canvg/issues/1749" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-10T16:15:13Z" - } -} \ No newline at end of file