地图 / Media parsing in canvas is at least vulnerable to Denial of Service through multiple vulnerabilities

Media parsing in canvas is at least vulnerable to Denial of Service through multiple vulnerabilities

内存破坏 / 经典缓冲区溢出 / #315037

厂商: Node.js third-party modules
严重程度: 低危
赏金: —
弱点: 经典缓冲区溢出
研究员: @webtonull
披露日期: 2019-04-03
资产: canvas
CVE: CVE-2020-8215

该报告还没有中文解读。

原文摘录

摘自原文（1448 字符中的一小部分）

There is at least a DoS vulnerability in canvas. It segfaults node.js which leads to a Denial of Service, but according to !exploitable it could possibly be worse

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Node.js third-party modules 所有。

时间线

2018-02-11报告提交
2019-04-03公开披露

阅读 HackerOne 原文 ↗作者 @webtonull · 版权归作者与 Node.js third-party modules 所有

同类报告

RCE on Steam Client via buffer overflow in Server InfoValve · 2019-03-15 Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionValve · 2020-02-27 Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exeValve · 2020-03-25 · $10,000 Remote vulnerabilities in sppPlayStation · 2024-04-25 · $12,500 Buffer overrun in Steam SILK voice decoderValve · 2021-09-13 · $7,500 [Portal 2] Remote Code Execution via voice packetsValve · 2021-05-10 · $5,000

Media parsing in canvas is at least vulnerable to Denial of Service through multiple vulnerabilities · 破甲 POJIA