UBUNTU-CVE-2017-15897
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-15897
Summary:
Details: Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
References: https://ubuntu.com/security/CVE-2017-15897, https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/, https://www.cve.org/CVERecord?id=CVE-2017-15897
Affected packages
Package
Name: nodejs
Purl: pkg:deb/ubuntu/[email protected]~dfsg-2?arch=source&distro=bionic
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -8.10.0~dfsg-2
Affected versions
6.11.4~dfsg-1ubuntu1
6.11.4~dfsg-1ubuntu2
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
