Homepage

Out-of-bounds Write Affecting nodejs package, versions *

Severity

 Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
1.72% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-NODEJS-312696
  • published22 Aug 2018
  • disclosed21 Aug 2018
Report a new vulnerability Found a mistake?

Introduced: 21 Aug 2018

CVE-2018-12115  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

There is no fixed version for Ubuntu:14.04 nodejs.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Ubuntu. See How to fix? for Ubuntu:14.04 relevant fixed versions and status.

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.