-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bsdiff4 | pip | < 1.2.0 | 1.2.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe commit diff shows critical changes to bounds checking logic in the patch function. The vulnerability stemmed from: 1. Initial combined check of both diffPtr and extraPtr bounds before x processing 2. Lack of separate validation for extraPtr bounds after x processing before memcpy. The fix separated these checks, moving extraPtr validation to after x operations. This directly corresponds to CWE-787 (OOB write) described in the advisory, as malicious 'y' values could cause memcpy to write beyond newData buffer limits.
Ongoing coverage of React2Shell