Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-25465: Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).

CVE-2020-25465 · published 5 years ago

Summary

Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).

What to do

Update moddable moddable to version os200908 or later.

Affected software

Vendor	Product	Affected versions
moddable	moddable	< os200908 `cpe:2.3:a:moddable:moddable::::::::`

Original advisory text

Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).

References

https://github.com/Moddable-OpenSource/moddable/issues/442 Exploit Third Party Advisory
https://github.com/Moddable-OpenSource/moddable/releases/tag/OS200908 Release Notes Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published4 Dec 2020

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-25465 · NVD

Track software like this

Free during beta