CVE-2017-15897

 

Published at: - 11-12-2017 10:29

Last modified: - 01-09-2022 06:22

Total changes: - 2

Description

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

 

Keywords

NVD

 

CVE-2017-15897

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures