CVE-2015-5380
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
La función de Utf8DecoderBase::WriteUtf16Slow en unicode.decoder.cc en Google V8, al igual que como se usa en Node.js anterior a 0.12.6, io.js anterior a 1.8.3 y 2.x antes de 2.3.3 y otros productos, no verifica que haya memoria disponible para un par surrogado UTF-16, lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) o la posibilidad de causar otro impacto a través de una secuencia de bytes manipulada.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-07-06 CVE Reserved
- 2015-07-09 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/75556 | Vdb Entry | |
| https://codereview.chromium.org/1226493003 | X_refsource_confirm | |
| https://github.com/joyent/node/issues/25583 | X_refsource_confirm | |
| https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable | 2023-11-07 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | V8 Search vendor "Google" for product "V8" | - | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | <= 1.8.2 Search vendor "Iojs" for product "Io.js" and version " <= 1.8.2" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.0.0 Search vendor "Iojs" for product "Io.js" and version "2.0.0" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.0.1 Search vendor "Iojs" for product "Io.js" and version "2.0.1" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.0.2 Search vendor "Iojs" for product "Io.js" and version "2.0.2" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.1.0 Search vendor "Iojs" for product "Io.js" and version "2.1.0" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.2.0 Search vendor "Iojs" for product "Io.js" and version "2.2.0" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.2.1 Search vendor "Iojs" for product "Io.js" and version "2.2.1" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.3.0 Search vendor "Iojs" for product "Io.js" and version "2.3.0" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.3.1 Search vendor "Iojs" for product "Io.js" and version "2.3.1" | - |
Affected
| ||||||
| Iojs Search vendor "Iojs" | Io.js Search vendor "Iojs" for product "Io.js" | 2.3.2 Search vendor "Iojs" for product "Io.js" and version "2.3.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | <= 0.12.5 Search vendor "Nodejs" for product "Node.js" and version " <= 0.12.5" | - |
Affected
| ||||||