Ubuntu.comUB:CVE-2018-7167CVE-2018-7167
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.002 Low
EPSS
Percentile
65.0%
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a
hang which could result in a Denial of Service. In order to address this
vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were
updated so that they zero fill instead of hanging in these cases. All
versions of Node.js 6.x (LTS “Boron”), 8.x (LTS “Carbon”), and 9.x are
vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
References
launchpad.net/bugs/cve/CVE-2018-7167
nodejs.org/en/blog/vulnerability/june-2018-security-releases/
nodejs.org/en/blog/vulnerability/june-2018-security-releases/#calls-to-buffer-fill-and-or-buffer-alloc-may-hang-cve-2018-7167
nvd.nist.gov/vuln/detail/CVE-2018-7167
security-tracker.debian.org/tracker/CVE-2018-7167
ubuntu.com/security/notices/USN-4796-1
www.cve.org/CVERecord?id=CVE-2018-7167
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.002 Low
EPSS
Percentile
65.0%