Bug 13859

Please patch CVEs for package hermes version 1.3.3
  
INFO (CVEs are): hermes 1.3.3
 cves found
CVE-2020-1914
Desc: A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1914
Severity: CRITICAL
CVE-2020-1915
Desc: An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1915
Severity: HIGH
CVE-2022-40138
Desc: An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-40138
Severity: CRITICAL
CVE-2023-23556
Desc: An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-23556
Severity: CRITICAL
CVE-2023-23557
Desc: An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-23557
Severity: CRITICAL
CVE-2023-24832
Desc: A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-24832
Severity: HIGH
CVE-2023-24833
Desc: A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-24833
Severity: HIGH