PT-2017-14275 · Node.Js+1 · Node.Js+1

Publicado

2017-12-11

·

Atualizado

2022-09-01

·

CVE-2017-15897

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Node.js versions 8.X through 9.X
Description The issue arises when the encoding for the fill value does not match the encoding specified, causing buffers to not be initialized correctly. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex")' would be problematic. The buffer implementation was updated to initialize the buffer to all zeros in such cases.
Recommendations For Node.js versions 8.X through 9.X, update the buffer implementation to initialize buffers to all zeros when the encoding for the fill value does not match the encoding specified. As a temporary workaround, consider initializing buffers manually to all zeros in cases where encoding mismatches occur.

Exploit

Correção

Improper Initialization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2017-15897
SUSE-SU-2019:14246-1
SUSE-SU-2019_14246-1

Produtos afetados

Node.Js
Suse