Description
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- nodejs / node.js6.14.4
- RedHat / openshift_container_platform3.11 – 3.11
- The Node.js Project / Node.jsAll versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 – All versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0
References
- MISChttp://www.securityfocus.com/bid/105127
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2552
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2553
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2944
- MISChttps://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:3537
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2949
- MISChttps://security.gentoo.org/glsa/202003-48
Updated 23m ago · 8 sources