CVE-2016-10666: Critical severity yandex tomita-parser vulnerability
tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10666?
CVE-2016-10666 has a medium severity due to its potential for remote code execution through untrusted binary resources.
What software versions are affected by CVE-2016-10666?
CVE-2016-10666 affects Yandex Tomita-parser versions up to and including 0.0.3.
How do I fix CVE-2016-10666?
To fix CVE-2016-10666, upgrade to a newer version of Yandex Tomita-parser that addresses this vulnerability.
What kind of attacks can exploit CVE-2016-10666?
CVE-2016-10666 can be exploited through man-in-the-middle (MITM) attacks, potentially leading to remote code execution.
Is there a workaround for CVE-2016-10666?
A possible workaround for CVE-2016-10666 includes ensuring that binary resources are fetched over HTTPS instead of HTTP.