Yüksek CVSS 7.5
CVE-2018-12115: Node.js: sınır dışı yazma
Açıklama (NVD)
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
Özet bilgiler
- Ürün
- Nodejs Node.js
- CVSS v3.1
- 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %7,78 (yüzdelik 95)
- CWE
- CWE-787
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| nodejs-node.js | — | — | 6.14.4 |
| nodejs-node.js | 8.0.0 | — | 8.11.4 |
| nodejs-node.js | 10.0.0 | — | 10.9.0 |
| redhat-openshift-container-platform | 3.11 | 3.11 | — |