← Volver a CVEs
CVE-2022-40138
CRITICAL9.8
Descripcion
An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Detalles CVE
Puntuacion CVSS v3.19.8
SeveridadCRITICAL
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioNONE
Publicado10/11/2022
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
facebook:hermes
Debilidades (CWE)
CWE-681CWE-681
Referencias
https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097(cve-assign@fb.com)
https://www.facebook.com/security/advisories/CVE-2022-40138(cve-assign@fb.com)
https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097(af854a3a-2127-422b-91ae-364da2661108)
https://www.facebook.com/security/advisories/CVE-2022-40138(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.