CVE-2022-22895: 
Homebrew vulnerability analysis and mitigation

JerryScript version 3.0.0 was discovered to contain a heap-buffer-overflow vulnerability (CVE-2022-22895) in the ecmautf8stringtonumberbyradix function located in /jerry-core/ecma/base/ecma-helpers-conversion.c. The vulnerability was disclosed on January 21, 2022 and received a CVSS v3 Base Score of 7.8 (AttackerKB).

The vulnerability is a heap-buffer-overflow that occurs in the ecmautf8stringtonumberbyradix function when processing string to number conversions. The issue can be triggered through specific test cases involving number conversion operations with hexadecimal values. The vulnerability requires local access and user interaction to be exploited, as indicated by the CVSS metrics: Attack Vector (AV): Local, Attack Complexity (AC): Low, Privileges Required (PR): None, User Interaction (UI): Required (AttackerKB).

If successfully exploited, this vulnerability could lead to high impacts on confidentiality, integrity, and availability of the affected system. The CVSS scoring indicates high impact scores for all three security metrics - Confidentiality (C): High, Integrity (I): High, Availability (A): High (AttackerKB).

The vulnerability was fixed in a patch that addresses the buffer overflow in string radix conversion. The fix was implemented through pull request #4850 in the JerryScript repository (GitHub PR).