id: PYSEC-2020-93
details: A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0
  allows remote attackers to potentially exploit heap corruption.
affected:
- package:
    name: py-mini-racer
    ecosystem: PyPI
    purl: pkg:pypi/py-mini-racer
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.3.0
  versions:
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5.dev0
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
  - 0.1.10
  - 0.1.11
  - 0.1.12
  - 0.1.13
  - 0.1.14
  - 0.1.15
  - 0.1.17
  - 0.1.18
  - 0.2.0b1
  - 0.2.0b2
  - 0.2.0
references:
- type: ARTICLE
  url: https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/
- type: WEB
  url: https://github.com/sqreen/PyMiniRacer/compare/v0.2.0...v0.3.0
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vwcg-7xqw-qcxw
aliases:
- CVE-2020-25489
- GHSA-vwcg-7xqw-qcxw
modified: '2020-09-24T13:39:00Z'
published: '2020-09-17T18:15:00Z'