Vulnerability CVE-2014-5256
Published: 2014-09-05

Description:
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

See advisories in our WLB2 database:
Topic
Author
Date
High
V8 Memory Corruption and Stack Overflow
Tom
05.09.2014

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Nodejs -> Nodejs 

 References:
http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/
https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356
http://www.mandriva.com/security/advisories?name=MDVSA-2015:142
http://www-01.ibm.com/support/docview.wss?uid=swg21684769
http://advisories.mageia.org/MGASA-2014-0516.html
Copyright 2024, cxsecurity.com

 

Back to Top