CVE-2024-3187 — Double Free in Goahead

CWE-415 — Double FreeCWE-416 — Use After FreeCWE-393 — Return of Wrong Status Code4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
4.3%
top 11.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Embedthis Goahead
Timeline
PublishedOct 17

Description

This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, cod…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:HExploitability: 1.6 | Impact: 4.2

Affected Packages1 packages

▶CVEListV5embedthis/goahead6.0.0

🔴Vulnerability Details

2
CVEList
CVE-2024-3187: This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6↗2024-10-17
▶
GHSA
GHSA-49c2-3ppg-7626: This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6↗2024-10-17
▶

📋Vendor Advisories

1
Red Hat
kernel: f2fs: fix return value of f2fs_convert_inline_inode()↗2024-08-17
▶
CVE-2024-3187 — Double Free in Embedthis Goahead | cvebase