Homepage

org.ow2.asm:asm@4.0

  • latest version

    9.11.1

  • latest non vulnerable version

    9.11.1

  • first published

    14 years ago

  • latest version published

    9 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.ow2.asm:asm package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Inefficient Algorithmic Complexity

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames() and computeMaxStackAndLocal() methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTE_FRAMES or COMPUTE_MAXS, it allocates excessive Edge objects, causing an OutOfMemoryError that crashes the JVM.

    How to fix Inefficient Algorithmic Complexity?

    Upgrade org.ow2.asm:asm to version 9.11 or higher.

    [3.0,9.11)
    • M
    Memory Allocation with Excessive Size Value

    Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors() method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM processes the subroutine.

    Notes

    • The attacker must get a user to load or process the crafted class file.

    How to fix Memory Allocation with Excessive Size Value?

    Upgrade org.ow2.asm:asm to version 9.11 or higher.

    [3.0,9.11)
    • M
    Uncontrolled Recursion

    Affected versions of this package are vulnerable to Uncontrolled Recursion via the parseType method in SignatureReader. An attacker can trigger a StackOverflowError and disrupt class transformation by supplying a crafted class file with a Signature attribute containing deeply nested generic type arguments.

    How to fix Uncontrolled Recursion?

    Upgrade org.ow2.asm:asm to version 9.11 or higher.

    [3.0,9.11)
    • M
    Inefficient Algorithmic Complexity

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with ClassWriter.COMPUTE_FRAMES; their methods make frame computation’s fixpoint algorithm converge slowly.

    How to fix Inefficient Algorithmic Complexity?

    Upgrade org.ow2.asm:asm to version 9.11 or higher.

    [3.0,9.11)
    Go back to all versions of this package