CVE-2018-7167CWE-119

CVE-2018-7167

High · published June 13, 2018

CVSS v3.1
7.5
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.06873 · 94.0th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2018-06-13T20:29Z
Affected products (3)
ProductVersionsFixed in
nodejs/node.js> 6.9.0, < 6.14.36.14.3
nodejs/node.js≥ 8.9.0, < 8.11.38.11.3
nodejs/node.js≥ 9.0.0, < 9.11.29.11.2
References (6)
http://www.securityfocus.com/bid/106363 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]http://www.securityfocus.com/bid/106363 · af854a3a-2127-422b-91ae-364da2661108https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 JUN 16:00Z
    Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service
    cvelistv5