CVE-2024-42328CWE-476CWE-690

JS - Crash on empty HTTP server response

Low · published November 27, 2024

CVSS v3.1
3.3
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.7th percentile
Weaknesses
CWE-476 · NULL Pointer Dereference; CWE-690 · Unchecked Return Value to NULL Pointer Dereference
Published
2024-11-27T12:04Z
EPSS history
Timeline
  • 27 NOV 12:04Z
    JS - Crash on empty HTTP server response
    cvelistv5