Homepage

Out-of-bounds Write Affecting nodejs8-devel package, versions <8.11.4-3.8.2

Severity

 Recommended
0.0
high
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
1.72% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES150-NODEJS8DEVEL-2760999
  • published14 Apr 2022
  • disclosed24 Sept 2018
Report a new vulnerability Found a mistake?

Introduced: 24 Sep 2018

CVE-2018-12115  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade SLES:15.0 nodejs8-devel to version 8.11.4-3.8.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs8-devel package and not the nodejs8-devel package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names &#39;ucs2&#39;, &#39;ucs-2&#39;, &#39;utf16le&#39; and &#39;utf-16le&#39;), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.