https://github.com/commenthol/serialize-to-js/issues/3

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/

MITRE disputed

** DISPUTED ** The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file.

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OR
     *cpe:2.3:a:serialize-to-js_project:serialize-to-js:*:*:*:*:*:*:*:* versions up to (including) 1.1.1

OR
     *cpe:2.3:a:serialize-to-js_project:serialize-to-js:*:*:*:*:*:node.js:*:* versions up to (including) 1.1.1

https://github.com/commenthol/serialize-to-js/issues/3 Issue Tracking, Third Party Advisory

https://github.com/commenthol/serialize-to-js/issues/3 Broken Link, Issue Tracking, Third Party Advisory

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/ Exploit, Third Party Advisory

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/ Broken Link, Exploit, Third Party Advisory

CWE-400

CWE-835

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

CWE-400

OR
     *cpe:2.3:a:serialize-to-js_project:serialize-to-js:*:*:*:*:*:*:*:* versions up to (including) 1.1.1

https://github.com/commenthol/serialize-to-js/issues/3 No Types Assigned

https://github.com/commenthol/serialize-to-js/issues/3 Issue Tracking, Third Party Advisory

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/ No Types Assigned

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/ Exploit, Third Party Advisory

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife/ [No Types Assigned]

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife [No Types Assigned]

https://kay-malwarebenchmark.github.io/blog/cve-2017-15871-dos-through-iife [No Types Assigned]

** DISPUTED ** The deserialize function in serialize-to-js through 1.1.1 allows attackers to bypass intended access restrictions via vectors involving a "function()" substring, as demonstrated by a "function(){console.log(" call. NOTE: The vendor states 'In my understanding [this attack] just runs inside a "sandbox" and prints ... to a tty.'

** DISPUTED ** The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file.