CVE-2014-5256: Buffer Overflow

Published Sep 5, 2014

Updated

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

Affected Software

58 affected components

Nodejs Nodejs=0.8.0

Nodejs Nodejs=0.8.1

Nodejs Nodejs=0.8.2

Nodejs Nodejs=0.8.3

Nodejs Nodejs=0.8.4

Nodejs Nodejs=0.8.5

Nodejs Nodejs=0.8.6

Nodejs Nodejs=0.8.7

Nodejs Nodejs=0.8.8

Nodejs Nodejs=0.8.9

Nodejs Nodejs=0.8.10

Nodejs Nodejs=0.8.11

Nodejs Nodejs=0.8.12

Nodejs Nodejs=0.8.13

Nodejs Nodejs=0.8.14

Nodejs Nodejs=0.8.15

Nodejs Nodejs=0.8.16

Nodejs Nodejs=0.8.17

Nodejs Nodejs=0.8.18

Nodejs Nodejs=0.8.19

Nodejs Nodejs=0.8.20

Nodejs Nodejs=0.8.21

Nodejs Nodejs=0.8.22

Nodejs Nodejs=0.8.23

Nodejs Nodejs=0.8.24

Nodejs Nodejs=0.8.25

Nodejs Nodejs=0.8.26

Nodejs Nodejs=0.8.27

Nodejs Nodejs=0.10.0

Nodejs Nodejs=0.10.1

Nodejs Nodejs=0.10.2

Nodejs Nodejs=0.10.3

Nodejs Nodejs=0.10.4

Nodejs Nodejs=0.10.5

Nodejs Nodejs=0.10.6

Nodejs Nodejs=0.10.7

Nodejs Nodejs=0.10.8

Nodejs Nodejs=0.10.9

Nodejs Nodejs=0.10.10

Nodejs Nodejs=0.10.11

Nodejs Nodejs=0.10.12

Nodejs Nodejs=0.10.13

Nodejs Nodejs=0.10.14

Nodejs Nodejs=0.10.15

Nodejs Nodejs=0.10.16

Nodejs Nodejs=0.10.17

Nodejs Nodejs=0.10.18

Nodejs Nodejs=0.10.19

Nodejs Nodejs=0.10.20

Nodejs Nodejs=0.10.21

Nodejs Nodejs=0.10.22

Nodejs Nodejs=0.10.23

Nodejs Nodejs=0.10.24

Nodejs Nodejs=0.10.25

Nodejs Nodejs=0.10.26

Nodejs Nodejs=0.10.27

Nodejs Nodejs=0.10.28

Nodejs Nodejs=0.10.29

Remediation

Patch Available

http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/

Event History

Sep 5, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5256?

CVE-2014-5256 is considered a high severity vulnerability due to its potential to cause denial of service through memory corruption and application crashes.

How do I fix CVE-2014-5256?

To fix CVE-2014-5256, you should upgrade Node.js to version 0.8.28 or later, or 0.10.30 or later.

What versions of Node.js are affected by CVE-2014-5256?

CVE-2014-5256 affects Node.js versions prior to 0.8.28 and 0.10.30.

What type of attack does CVE-2014-5256 enable?

CVE-2014-5256 enables remote attackers to execute denial of service attacks that can crash the application.

Is CVE-2014-5256 related to JSON processing?

Yes, CVE-2014-5256 relates to vulnerabilities in JSON processing that can trigger V8 garbage collection issues.