logo

Database

Insecure service configuration In uglify-js

Description

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

Recommendation

Upgrade UglifyJS to version >= 2.4.24.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2015-88572. NVD-2015-88573. OSV-DEBIAN-2015-88574. OSV-2015-88575. GCVE-2015-88576. SECURITY-TRACKER-CVE-2015-8857

References

1. https://github.com/mishoo/UglifyJS2/issues/7512. https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e3. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml4. https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/964105. https://zyan.scripts.mit.edu/blog/backdooring-js6. http://www.openwall.com/lists/oss-security/2016/04/20/11

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.