Out-of-bounds write in nodejs (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-12115 |
| CWE-ID | CWE-787 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
nodejs (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Out-of-bounds write
EUVDB-ID: #VU14498
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-12115
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to an out-of-bounds write condition in the Buffer component when used with UCS-2 encoding. A local attacker can cause a targeted system to stop functioning or execute arbitrary code with elevated privileges.
MitigationInstall update from vendor's website.
Vulnerable software versionsnodejs (Alpine package): 6.2.0-r0 - 8.11.3-r3
External linkshttp://git.alpinelinux.org/aports/commit/?id=924ddd9b07eef52050c03046380e37532bd2f6d3
http://git.alpinelinux.org/aports/commit/?id=92947a81c0654add42b67742a3d44a6e6fa5720e
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
