CVE-2019-16366
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In XS 9.0.0 in Moddable SDK OS180329, there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c, as demonstrated by crafted JavaScript code to xst.
En XS versión 9.0.0 en Moddable SDK versión OS180329, presenta un desbordamiento de búfer en la región heap de la memoria en la función fxBeginHost en el archivo xsAPI.c cuando se llama desde la función fxRunDefine en el archivo xsRun.c, como es demostrado mediante el código JavaScript diseñado para xst.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-09-16 CVE Reserved
- 2019-09-16 CVE Published
- 2023-08-23 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/Moddable-OpenSource/moddable/issues/235 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Moddable Search vendor "Moddable" | Moddable Search vendor "Moddable" for product "Moddable" | os180329 Search vendor "Moddable" for product "Moddable" and version "os180329" | - |
Affected
| ||||||
| Moddable Search vendor "Moddable" | Xs Search vendor "Moddable" for product "Xs" | 9.0.0 Search vendor "Moddable" for product "Xs" and version "9.0.0" | - |
Affected
| ||||||