CVE search · CVE-2018-7167
CVE-2018-7167
high 7.5
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve-request@iojs.org
- Weakness
- CWE-119
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- nodejs · node.js
References
- http://www.securityfocus.com/bid/106363Third Party AdvisoryVDB Entry
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/Vendor Advisory
- https://security.gentoo.org/glsa/202003-48Third Party Advisory
- http://www.securityfocus.com/bid/106363Third Party AdvisoryVDB Entry
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/Vendor Advisory
- https://security.gentoo.org/glsa/202003-48Third Party Advisory