CVE-2015-8027
published 2016-01-02CVE-2015-8027: Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
5.36%
91.8th percentile
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | — | — |
| debian | nodejs | < nodejs 4.2.3~dfsg-1 (bookworm) | nodejs 4.2.3~dfsg-1 (bookworm) |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | nodejs | >= 0 < 4.2.3~dfsg-1 | 4.2.3~dfsg-1 |
| nodejs | nodejs | >= 0 < 4.2.3~dfsg-1 | 4.2.3~dfsg-1 |
| nodejs | nodejs | >= 0 < 4.2.3~dfsg-1 | 4.2.3~dfsg-1 |
| nodejs | nodejs | >= 0 < 4.2.3~dfsg-1 | 4.2.3~dfsg-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2015-8027: Xcode 8.1
vendor_apple·2016-10-27·CVSS 7.5
CVE-2015-8027 [HIGH] CVE-2015-8027: Xcode 8.1
Apple Security Update: About the security content of Xcode 8.1
Product: Xcode
Version: 8.1
CVE: CVE-2015-8027
Component: CVE-2015-8027
Red Hat
nodejs: unspecified denial of service vulnerability
vendor_redhat·2015-11-25·CVSS 7.5
CVE-2015-8027 [HIGH] nodejs: unspecified denial of service vulnerability
nodejs: unspecified denial of service vulnerability
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Statement: This issue did not affect the versions of nodejs as shipped with Red Hat Enterprise Software Collections version 2, Red Hat OpenStack Platform and Red Hat Openshift Enterprise and Openshift Online as they do not include the vulnerable version of nodejs.
Package: nodejs (OpenShift Enterprise 1) - Not affected
Package: nodejs (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: nodejs010-nodejs (Red Hat Software Collection
Debian
CVE-2015-8027: nodejs - Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not en...
vendor_debian·2015·CVSS 7.5
CVE-2015-8027 [HIGH] CVE-2015-8027: nodejs - Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not en...
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Scope: local
bookworm: resolved (fixed in 4.2.3~dfsg-1)
bullseye: resolved (fixed in 4.2.3~dfsg-1)
forky: resolved (fixed in 4.2.3~dfsg-1)
sid: resolved (fixed in 4.2.3~dfsg-1)
trixie: resolved (fixed in 4.2.3~dfsg-1)
GHSA
GHSA-pvxc-6v2c-cv7w: Node
ghsa_unreviewed·2022-05-17
CVE-2015-8027 [HIGH] GHSA-pvxc-6v2c-cv7w: Node
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
OSV
CVE-2015-8027: Node
osv·2016-01-02·CVSS 7.5
CVE-2015-8027 [HIGH] CVE-2015-8027: Node
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-6764 v8: unspecified out-of-bounds access vulnerability
bugzilla·2015-11-26·CVSS 9.8
CVE-2015-6764 [CRITICAL] CVE-2015-6764 v8: unspecified out-of-bounds access vulnerability
CVE-2015-6764 v8: unspecified out-of-bounds access vulnerability
An out-of-bounds access vulnerability in Node.js:
An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application, but only under circumstances where an attacker may cause user-supplied JavaScript to be executed within a Node.js application.
Full details of this vulnerability are embargoed until new releases are available on Wednesday the 2nd of December 2015, UTC (Tuesday the 1st of December US time).
The versions reported as vulnerable (4.x and 5.x) are not shipped in any Red Hat product. This bug will be updated with further information when more details are avail
Bugzilla
CVE-2015-8027 nodejs: unspecified denial of service vulnerability
bugzilla·2015-11-26·CVSS 7.5
CVE-2015-8027 [HIGH] CVE-2015-8027 nodejs: unspecified denial of service vulnerability
CVE-2015-8027 nodejs: unspecified denial of service vulnerability
A denial of service flaw was reported in Node.js:
A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service.
Full details of this vulnerability are embargoed until new releases are available on Wednesday the 2nd of December 2015, UTC (Tuesday the 1st of December US time).
The versions reported as vulnerable (0.12.x to 5.x) are not shipped in any Red Hat product. This bug will be updated with further information when more details are available.
External References:
https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/
Discussion:
Statement:
This issue did not affect the versions of nodejs as shipped with Red Hat Enterprise So
Bugzilla
CVE-2015-1545 openldap: slapd crashes on search with deref control and empty attr list
bugzilla·2015-02-09·CVSS 5.0
CVE-2015-1545 [MEDIUM] CVE-2015-1545 openldap: slapd crashes on search with deref control and empty attr list
CVE-2015-1545 openldap: slapd crashes on search with deref control and empty attr list
It was reported [1] that with the deref overlay enabled, ldapsearch with '-E deref=member:' causes slapd to crash.
Upstream bugreport: http://www.openldap.org/its/?findid=8027
Upstream commit: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=7a5a98577a0481d864ca7fe05b9b32274d4d1fb5
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988
Discussion:
Created openldap tracking bugs for this issue:
Affects: fedora-all [bug 1190645]
---
Statement:
This issue did not affect the versions of openldap as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include support for the deref overlay.
http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg1IV79524http://www-01.ibm.com/support/docview.wss?uid=swg21972419http://www.securityfocus.com/bid/78207https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/https://security.gentoo.org/glsa/201612-43http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg1IV79524http://www-01.ibm.com/support/docview.wss?uid=swg21972419http://www.securityfocus.com/bid/78207https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/https://security.gentoo.org/glsa/201612-43
2016-01-02
Published