UBUNTU-CVE-2018-7167

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2018-7167

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-7167.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-7167

Related

Published

2018-06-13T16:29:00Z

Modified

2018-06-13T16:29:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

References

Affected packages

Ubuntu:Pro:16.04:LTS / nodejs

Package

Name: nodejs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.25~dfsg2-2ubuntu1

4.*

4.2.2~dfsg-1

4.2.3~dfsg-1

4.2.4~dfsg-1ubuntu1

4.2.4~dfsg-2

4.2.6~dfsg-1ubuntu1

4.2.6~dfsg-1ubuntu4

4.2.6~dfsg-1ubuntu4.1

4.2.6~dfsg-1ubuntu4.2

4.2.6~dfsg-1ubuntu4.2+esm1

4.2.6~dfsg-1ubuntu4.2+esm2

4.2.6~dfsg-1ubuntu4.2+esm3

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs@8.10.0~dfsg-2ubuntu0.4+esm1?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.10.0~dfsg-2ubuntu0.4+esm1

Affected versions

6.*

6.11.4~dfsg-1ubuntu1

6.11.4~dfsg-1ubuntu2

6.12.0~dfsg-1ubuntu1

6.12.0~dfsg-2ubuntu1

6.12.0~dfsg-2ubuntu2

8.*

8.10.0~dfsg-2

8.10.0~dfsg-2ubuntu0.2

8.10.0~dfsg-2ubuntu0.3

8.10.0~dfsg-2ubuntu0.4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "nodejs-dev": "8.10.0~dfsg-2ubuntu0.4+esm1",
            "nodejs-doc": "8.10.0~dfsg-2ubuntu0.4+esm1",
            "nodejs": "8.10.0~dfsg-2ubuntu0.4+esm1",
            "nodejs-dbgsym": "8.10.0~dfsg-2ubuntu0.4+esm1"
        }
    ]
}