CVE-2019-13617

published 2019-07-16

CVE-2019-13617: njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an…

medium 6.5 CVSS 3.0

AV N AC L PR N UI R S U C N I N A H

njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regexp_literal call that leads to an njs_parser_lexer_error call and then an njs_parser_scope_error call.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
f5	njs	<= 0.3.3	—

CWE-125