Threats affecting pkg:github/QuickJS-NG

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_typed_array_sort() function. This flaw allows attackers running JavaScript to trigger a heap buffer overflow on 32-bit systems by sorting a very large typed array with a comparator. The overflow can lead to crashes or potentially arbitrary code execution.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_proxy_get_own_property_names() function. This flaw causes a heap buffer overflow on 32-bit hosts when JavaScript code returns a large array-like object from a Proxy ownKeys trap. The vulnerability can lead to crashes or potentially allow code execution.