Vulnerability · Published Sep 20, 2023 · Assigned by mitre
CVE-2023-36109
Critical 9.8
In plain English
A critical-severity security flaw in the iotjs package (Ubuntu). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | iotjs | no fix listed | UBUNTU-CVE-2023-36109 |