CVE-2015-5380

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and…

published July 9, 2015

CVSS
—
EPSS
3%
Percentile
87.2
In the wild
Unconfirmed
What it is

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02974 · 87.2th percentile
Published
2015-07-09T10:00Z
EPSS history
Timeline
  • 09 JUL 10:00Z
    The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and…
    cvelistv5