chameleon-sdk-android icon indicating copy to clipboard operation
chameleon-sdk-android copied to clipboard

Published 20 hours ago • verified publisher icon chameleon-team

Known vulnerabilities in shared library which weexbridge depends on.Can you help upgrade to patch versions?

Open HelenParr opened this issue 2 years ago • 0 comments

Hi, @sxychenjing , @Summer500 , I'd like to report a vulnerability issue in com.didiglobal.chameleon:weexbridge:0.0.13.9.

Issue Description

com.didiglobal.chameleon:weexbridge:0.0.13.9 depends on 2 C libraries (.so). However, I noticed that one C shared library is vulnerable, containing the following CVEs:

libfreetype.so from C project libpng(version:1.6.23) exposed 2 vulnerabilities: CVE-2017-12652, CVE-2016-10087

Suggested Vulnerability Patch Versions

libpng has fixed the vulnerabilities in versions >=1.6.37

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~ Best regards, Hele Parr

HelenParr avatar Apr 26 '22 09:04 HelenParr