Memory Exposure in bl · GHSA-wrw9-m778-g6mc · GitHub Advisory Database · GitHub

Memory Exposure in bl

Moderate severity GitHub Reviewed Published Jun 3, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

bl (npm)

Affected versions

< 0.9.5

= 1.0.0

Patched versions

0.9.5

1.0.1

Description

Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory

Recommendation

Update to version 0.9.5, 1.0.1 or later.

References

Reviewed Jun 3, 2019

Published to the GitHub Advisory Database Jun 3, 2019

Last updated Jan 9, 2023