CVE-2015-5380: Buffer Overflow
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5380?
CVE-2015-5380 is considered a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2015-5380?
To fix CVE-2015-5380, upgrade your Node.js to version 0.12.6 or later, or io.js to version 1.8.3 or later.
Which software is affected by CVE-2015-5380?
CVE-2015-5380 affects Node.js versions before 0.12.6 and io.js versions before 1.8.3.
What is the impact of CVE-2015-5380?
The impact of CVE-2015-5380 is the ability for remote attackers to cause a denial of service through crafted UTF-16 surrogate pairs.
Is CVE-2015-5380 related to Google V8?
Yes, CVE-2015-5380 originates from a vulnerability in the Utf8DecoderBase::WriteUtf16Slow function used in Google V8.