Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Vulnerability Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
Vulnerability Type
跨界内存读
Vulnerability Title
Electron 缓冲区错误漏洞
Vulnerability Description
Electron是Electron开源的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron 38.8.6之前版本、39.8.1之前版本、40.8.1之前版本和41.0.0之前版本存在缓冲区错误漏洞，该漏洞源于在macOS和Linux上调用app.requestSingleInstanceLock时解析特制的第二个实例消息存在越界堆读取问题，可能导致内存泄露。
CVSS Information
N/A
Vulnerability Type
N/A