{"id":"GHSA-86mr-6m89-vgj3","aliases":[],"url":"https://o3.security/vulnerability/GHSA-86mr-6m89-vgj3","summary":"Buffer Overflow in node-weakauras-parser","details":"Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems.\n\n\n## Recommendation\n\nUpgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.","published":"2020-09-03T15:51:38Z","modified":"2021-10-04T21:10:07Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"node-weakauras-parser","fixedVersion":"1.0.5"},{"ecosystem":"npm","name":"node-weakauras-parser","fixedVersion":"2.0.2"},{"ecosystem":"npm","name":"node-weakauras-parser","fixedVersion":"3.0.1"}],"fix":{"url":"https://github.com/Zireael-N/node-weakauras-parser/commit/bc146da09db689e554d28e948f1cf1c138f09f69#diff-023afe6291ac9ada88788108cb3367b3R38-R43","label":"Zireael-N/node-weakauras-parser@bc146da"},"references":[{"type":"WEB","url":"https://github.com/Zireael-N/node-weakauras-parser/commit/bc146da09db689e554d28e948f1cf1c138f09f69#diff-023afe6291ac9ada88788108cb3367b3R38-R43"},{"type":"PACKAGE","url":"https://github.com/Zireael-N/node-weakauras-parser"},{"type":"WEB","url":"https://www.npmjs.com/advisories/1504"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-10-04T21:10:07Z"}}