Go to packages list

muhammara

Ecosystem: npm

Downloads: 194.86 K

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 5HighAffects 7 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
5vulnerabilities
  • Critical0 (0.0%)
  • High5 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 3 vulnerabilities
    • Critical: 0
    • High: 3
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (5)

Known vulnerabilities affecting muhammara, based on data from OSV.

Vulnerabilities affecting muhammara
IDSeveritySummaryAffected versionsPublishedSource
GHSA-fhp4-pr5j-46m5HighMuhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key## Summary A NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process. ## Affected Version muhammara <= 6.0.4 (latest) ## Vulnerability Details **File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107 ```cpp if (inDecodeParams) { PDFObjectCastPtr<PDFInteger> earlyObj( QueryDictionaryObject(inDecodeParams, "EarlyChange") ); early = earlyObj->Get
  • < 6.0.5
GitHub (opens in a new tab)
GHSA-2r7v-cmch-5x26Highmuhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference### Impact The package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. ### Patches It has been patched in 3.4.0 and has been backported to 2.6.2 There is no patch for hummus, currently ### Workarounds Do not process files from untrusted sources or update. Replace hummus with muhammara ### References https://github.com/julianhille/MuhammaraJS/pull/235 https://github.com/julianhille/MuhammaraJS/pull/238
  • >= 3.0.0, < 3.4.0
  • < 2.6.2
GitHub (opens in a new tab)
GHSA-rcrx-fpjp-mfrwHighUnchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp### Impact The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. ### Patches It has been patched in 2.6.0 for muhammara and not at all for hummus ### Workarounds Do not process files from untrusted sources ### References PR: https://github.com/julianhille/MuhammaraJS/pull/194 Issue: https://github.com/julianhille/MuhammaraJS/issues/191 Issue in hummus: https://github.com/galkahana/HummusJS/issues/293 ### Outline differences to https://nvd.nist.gov/vuln/detail/
  • < 2.6.0
GitHub (opens in a new tab)
GHSA-9cv5-4wqv-9w94Highmuhammara and hummus vulnerable to denial of service by NULL pointer dereference### Impact The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. ### Patches It has been patched in 3.1.1 and has been backported to 2.6.1 Hummus has a patch in 1.0.111. ### Workarounds Do not process files from untrusted sources or update. ### References https://nvd.nist.gov/vuln/detail/CVE-2022-25892 https://github.com/galkahana/HummusJS/issues/463 https://github.com/julianhille/MuhammaraJS/issues/214 https://github.com/julianhille/MuhammaraJS
  • < 2.6.1
  • >= 3.0.0, < 3.1.1
GitHub (opens in a new tab)
GHSA-frp9-2v6r-gj97Highmuhammara and hummus vulnerable to null pointer dereference on bad response objectThe package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
  • < 2.6.0
GitHub (opens in a new tab)
  • GHSA-fhp4-pr5j-46m5High
    Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
    • < 6.0.5
    GitHub (opens in a new tab)

    ## Summary A NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process. ## Affected Version muhammara <= 6.0.4 (latest) ## Vulnerability Details **File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107 ```cpp if (inDecodeParams) { PDFObjectCastPtr<PDFInteger> earlyObj( QueryDictionaryObject(inDecodeParams, "EarlyChange") ); early = earlyObj->Get

  • GHSA-2r7v-cmch-5x26High
    muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
    • >= 3.0.0, < 3.4.0
    • < 2.6.2
    GitHub (opens in a new tab)

    ### Impact The package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. ### Patches It has been patched in 3.4.0 and has been backported to 2.6.2 There is no patch for hummus, currently ### Workarounds Do not process files from untrusted sources or update. Replace hummus with muhammara ### References https://github.com/julianhille/MuhammaraJS/pull/235 https://github.com/julianhille/MuhammaraJS/pull/238

    CVE: CVE-2022-41957

  • GHSA-rcrx-fpjp-mfrwHigh
    Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
    • < 2.6.0
    GitHub (opens in a new tab)

    ### Impact The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. ### Patches It has been patched in 2.6.0 for muhammara and not at all for hummus ### Workarounds Do not process files from untrusted sources ### References PR: https://github.com/julianhille/MuhammaraJS/pull/194 Issue: https://github.com/julianhille/MuhammaraJS/issues/191 Issue in hummus: https://github.com/galkahana/HummusJS/issues/293 ### Outline differences to https://nvd.nist.gov/vuln/detail/

    CVE: CVE-2022-39381

  • GHSA-9cv5-4wqv-9w94High
    muhammara and hummus vulnerable to denial of service by NULL pointer dereference
    • < 2.6.1
    • >= 3.0.0, < 3.1.1
    GitHub (opens in a new tab)

    ### Impact The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. ### Patches It has been patched in 3.1.1 and has been backported to 2.6.1 Hummus has a patch in 1.0.111. ### Workarounds Do not process files from untrusted sources or update. ### References https://nvd.nist.gov/vuln/detail/CVE-2022-25892 https://github.com/galkahana/HummusJS/issues/463 https://github.com/julianhille/MuhammaraJS/issues/214 https://github.com/julianhille/MuhammaraJS

    CVE: CVE-2022-25892

  • GHSA-frp9-2v6r-gj97High
    muhammara and hummus vulnerable to null pointer dereference on bad response object
    • < 2.6.0
    GitHub (opens in a new tab)

    The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

    CVE: CVE-2022-25885

Showing 1-5 of 5 vulnerabilities