CVE-2023-29458 — Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

CVE-2023-29458

Duktape 2.6 bug crashes JavaScript putting too many values in valstack. PUBLISHED

Description (CNA)

Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 5,0,0 through 5.0.34; affected 6,0,0 through 6.0.17; affected 6.4.0 through 6.4.2; affected 7.0.0alpha1 through 7.0.0alpha1

CWE

CWE-129

References

https://support.zabbix.com/browse/ZBX-22989

ADP enrichment

CVE

No English description supplied.

https://support.zabbix.com/browse/ZBX-22989
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html

CISA-ADP

No English description supplied.

No references supplied.