muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
ImpactThe package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.PatchesIt has been patched in 3.4.0 and has been backported to 2.6.2
There is no patch for hummus, currentlyWorkaroundsDo not process files from untrusted sources or update.
Replace hummus with muhammaraReferenceshttps://github.com/julianhille/MuhammaraJS/pull/235
https://github.com/julianhille/MuhammaraJS/pull/238