From 92ab161f3d28f6b81d5b4e7b436646785b8965e0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 10 Jul 2024 20:44:50 +0000 Subject: [PATCH] Publish Advisories GHSA-7vhm-fmph-7wxw GHSA-g533-xq5w-jmf3 --- .../GHSA-7vhm-fmph-7wxw.json | 37 ++++++++++++++++--- .../GHSA-g533-xq5w-jmf3.json | 37 ++++++++++++++++--- 2 files changed, 64 insertions(+), 10 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json (62%) rename advisories/{unreviewed => github-reviewed}/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json (63%) diff --git a/advisories/unreviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json b/advisories/github-reviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json similarity index 62% rename from advisories/unreviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json rename to advisories/github-reviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json index e5e6fa56a6a..94601b007f8 100644 --- a/advisories/unreviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json +++ b/advisories/github-reviewed/2024/07/GHSA-7vhm-fmph-7wxw/GHSA-7vhm-fmph-7wxw.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-7vhm-fmph-7wxw", - "modified": "2024-07-10T06:33:52Z", + "modified": "2024-07-10T20:43:22Z", "published": "2024-07-10T06:33:51Z", "aliases": [ "CVE-2024-21522" ], + "summary": "audify vulnerable to Improper Validation of Array Index", "details": "All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "audify" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.9.0" + } + ] + } + ] + } ], "references": [ { @@ -25,9 +48,13 @@ "type": "WEB", "url": "https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e" }, + { + "type": "PACKAGE", + "url": "https://github.com/almoghamdani/audify" + }, { "type": "WEB", - "url": "https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L53" + "url": "https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp#L53" }, { "type": "WEB", @@ -43,8 +70,8 @@ "CWE-129" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-10T20:43:22Z", "nvd_published_at": "2024-07-10T05:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json b/advisories/github-reviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json similarity index 63% rename from advisories/unreviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json rename to advisories/github-reviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json index 66b2476fbb9..53cedab0136 100644 --- a/advisories/unreviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json +++ b/advisories/github-reviewed/2024/07/GHSA-g533-xq5w-jmf3/GHSA-g533-xq5w-jmf3.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-g533-xq5w-jmf3", - "modified": "2024-07-10T06:33:52Z", + "modified": "2024-07-10T20:43:35Z", "published": "2024-07-10T06:33:52Z", "aliases": [ "CVE-2024-21524" ], + "summary": "node-stringbuilder vulnerable to Out-of-bounds Read", "details": "All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "node-stringbuilder" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.2.7" + } + ] + } + ] + } ], "references": [ { @@ -25,9 +48,13 @@ "type": "WEB", "url": "https://gist.github.com/dellalibera/0bb022811224f81d998fa61c3175ee67" }, + { + "type": "PACKAGE", + "url": "https://github.com/magiclen/node-stringbuilder" + }, { "type": "WEB", - "url": "https://github.com/magiclen/node-stringbuilder/blob/5c2797d3d6bf8cb6d10fe1e077609cef9a5a7de0/src/node-stringbuilder.c%23L1281" + "url": "https://github.com/magiclen/node-stringbuilder/blob/5c2797d3d6bf8cb6d10fe1e077609cef9a5a7de0/src/node-stringbuilder.c#L1281" }, { "type": "WEB", @@ -39,8 +66,8 @@ "CWE-125" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-10T20:43:35Z", "nvd_published_at": "2024-07-10T05:15:11Z" } } \ No newline at end of file