Skip to main content

Out-of-bounds Read

CVE-2020-8244

Medium
6.5/10

Summary

A buffer over-read vulnerability exists in bl versions through 1.2.2, 2.0.0 through 2.2.0, 3.0.0, 4.0.0 through 4.0.2 which could allow an attacker to supply user input (even typed) that if it ends up in "consume()" argument and can become negative, the "BufferList" state can be corrupted, tricking it into exposing uninitialized memory via regular ".slice()" calls.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-125 - Out-of-Bounds Read

Out-of-bounds read is a vulnerability that allows access to memory beyond the authorized accessible location. Such a vulnerability compromises the confidentiality of the trusted environment in the application and enables an attacker to launch further attacks by leveraging the exposed information.

References

Advisory Timeline

  • Published