cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.
References
Link | Resource |
---|---|
https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-01-24T00:26:57.671Z
Updated:
Reserved: 2022-12-29T17:41:28.088Z
Link: CVE-2023-22485
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-01-24T01:15:10.593
Modified: 2023-02-02T14:11:44.717
Link: CVE-2023-22485
JSON object: View
Redhat Information
No data.