CVE-2014-5256
published 2014-09-05CVE-2014-5256: Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.26%
87.1th percentile
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Affected
63 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 0.10.38~dfsg-1 (bookworm) | nodejs 0.10.38~dfsg-1 (bookworm) |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
| nodejs | nodejs | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7wxw-9v42-w9g6: Node
ghsa_unreviewed·2022-05-17
CVE-2014-5256 [MEDIUM] CWE-119 GHSA-7wxw-9v42-w9g6: Node
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
OSV
CVE-2014-5256: Node
osv·2014-09-05·CVSS 5.0
CVE-2014-5256 [MEDIUM] CVE-2014-5256: Node
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Red Hat
V8: Memory Corruption and Stack Overflow
vendor_redhat·2014-07-31·CVSS 5.0
CVE-2014-5256 [MEDIUM] CWE-121 V8: Memory Corruption and Stack Overflow
V8: Memory Corruption and Stack Overflow
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
It was discovered that V8 did not properly check the stack size limit in certain cases. A remote attacker able to send a request that caused a script executed by V8 to use deep recursion could trigger a stack overflow, leading to a crash of an application using V8.
Statement: Red Hat Product Security has rated this issue as having Low security impact in Red Hat Enterprise Linux
Debian
CVE-2014-5256: nodejs - Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibil...
vendor_debian·2014·CVSS 5.0
CVE-2014-5256 [MEDIUM] CVE-2014-5256: nodejs - Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibil...
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Scope: local
bookworm: resolved (fixed in 0.10.38~dfsg-1)
bullseye: resolved (fixed in 0.10.38~dfsg-1)
forky: resolved (fixed in 0.10.38~dfsg-1)
sid: resolved (fixed in 0.10.38~dfsg-1)
trixie: resolved (fixed in 0.10.38~dfsg-1)
No detection rules found.
No public exploits indexed.
http://advisories.mageia.org/MGASA-2014-0516.htmlhttp://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/http://secunia.com/advisories/61260http://www-01.ibm.com/support/docview.wss?uid=swg21684769http://www.mandriva.com/security/advisories?name=MDVSA-2015:142https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356http://advisories.mageia.org/MGASA-2014-0516.htmlhttp://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/http://secunia.com/advisories/61260http://www-01.ibm.com/support/docview.wss?uid=swg21684769http://www.mandriva.com/security/advisories?name=MDVSA-2015:142https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356
2014-09-05
Published