Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpenjsf Packager
APPOpenjsf18.3.0
Powiązane podatności
WebdriverIO: command injection w orkiestracji testów prowadzący do RCE
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family U...
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the con...
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitte...
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its n...