CVE-2015-5380 Memory corruption in n/a
Remote attackers can cause denial of service or potential code execution via crafted byte sequences exploiting a memory corruption flaw in the V8 engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5380?
CVE-2015-5380 is a high-severity memory corruption vulnerability in Nodejs Node.js, published on 9 Jul 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Weakness: CWE-119
Which versions are affected by CVE-2015-5380?
It affects 3 products.
Products include Google V8, Iojs Io.js, Nodejs Node.js.
How do I fix CVE-2015-5380?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-5380 being exploited?
There is no known exploitation of CVE-2015-5380 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as GHSA-cpgp-qq89-2x6x.