CVE-2018-7167
published 2018-06-13CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
7.21%
93.7th percentile
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 10.15.0~dfsg-6 (bookworm) | nodejs 10.15.0~dfsg-6 (bookworm) |
| msrc | cm1_nodejs_14.17.2-1_on_cbl_mariner_1.0 | — | — |
| nodejs | node.js | < 6.14.3 | 6.14.3 |
| nodejs | node.js | >= 8.9.0 < 8.11.3 | 8.11.3 |
| nodejs | node.js | >= 9.0.0 < 9.11.2 | 9.11.2 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 0.10.25~dfsg2-2ubuntu1.2+esm1 | 0.10.25~dfsg2-2ubuntu1.2+esm1 |
| nodejs | nodejs | >= 0 < 4.2.6~dfsg-1ubuntu4.2+esm1 | 4.2.6~dfsg-1ubuntu4.2+esm1 |
| nodejs | nodejs | >= 0 < 8.10.0~dfsg-2ubuntu0.4+esm1 | 8.10.0~dfsg-2ubuntu0.4+esm1 |
| the_node.js_project | node.js | — | — |
| the_node.js_project | node.js | — | — |
| the_node.js_project | node.js | — | — |
| the_node.js_project | node.js | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jr5v-587f-389p: Calling Buffer
ghsa_unreviewed·2022-05-13
CVE-2018-7167 [HIGH] CWE-119 GHSA-jr5v-587f-389p: Calling Buffer
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
OSV
nodejs vulnerabilities
osv·2021-03-15·CVSS 5.9
CVE-2016-7099 [MEDIUM] nodejs vulnerabilities
nodejs vulnerabilities
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
cause a denial of service (crash) or possibly execute arbitrary co
OSV
CVE-2018-7167: Calling Buffer
osv·2018-06-13·CVSS 7.5
CVE-2018-7167 [HIGH] CVE-2018-7167: Calling Buffer
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 5.9
CVE-2018-7160 [MEDIUM] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
c
Microsoft
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability the implementations of Buffer.alloc()
vendor_msrc·2018-06-12·CVSS 7.5
CVE-2018-7167 [HIGH] CWE-119 Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability the implementations of Buffer.alloc()
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron") 8.x (LTS "Carbon") and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro
Red Hat
nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
vendor_redhat·2018-06-12·CVSS 7.5
CVE-2018-7167 [HIGH] CWE-20 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
It was found that the Buffer.fill() and Buffer.alloc() function may hang. An attacker able to control the input of these function could use this flaw to cause a denial of service.
Package: nodejs (Red Hat Enterprise Linux 8) - Not affected
Package: nodejs (
Debian
CVE-2018-7167: nodejs - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang ...
vendor_debian·2018·CVSS 7.5
CVE-2018-7167 [HIGH] CVE-2018-7167: nodejs - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang ...
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Scope: local
bookworm: resolved (fixed in 10.15.0~dfsg-6)
bullseye: resolved (fixed in 10.15.0~dfsg-6)
forky: resolved (fixed in 10.15.0~dfsg-6)
sid: resolved (fixed in 10.15.0~dfsg-6)
trixie: resolved (fixed in 10.15.0~dfsg-6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
bugzilla·2018-06-13·CVSS 7.5
CVE-2018-7167 [HIGH] CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters
A flaw was found in Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x. Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.
References:
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
Discussion:
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1591007]
Affects: fedora-all [bug 1591009]
---
Upstream fix:
https://github.com/nodejs/node/commit/7dbcfc6217
---
RHOAR NodeJS 10.4.1, has already been released with fixes for this issue.
---
While jenkins-slave-nodejs8 includes a vulnerable version of NodeJS 8, users are not able to affect other uses of the
Bugzilla
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [fedora-all]
bugzilla·2018-06-13·CVSS 7.5
CVE-2018-7167 [HIGH] CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [fedora-all]
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [epel-all]
bugzilla·2018-06-13·CVSS 7.5
CVE-2018-7167 [HIGH] CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [epel-all]
CVE-2018-7167 nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
http://www.securityfocus.com/bid/106363https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/https://security.gentoo.org/glsa/202003-48http://www.securityfocus.com/bid/106363https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/https://security.gentoo.org/glsa/202003-48
2018-06-13
Published