Red Hat Software Collections update for nodejs
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-7166 |
| CWE-ID | CWE-200 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Red Hat Software Collections Universal components / Libraries / Software for developers rh-nodejs10-nodejs (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Information disclosure
EUVDB-ID: #VU14493
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-7166
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to the Buffer.alloc() function of the affected software returns uninitialized memory. A local attacker can submit malicious arguments to the Buffer.alloc() function and cause a targeted system to return uncleared memory blocks that hold sensitive information.
MitigationInstall updates from vendor's website.
Red Hat Software Collections: 1 for RHEL 7.7
rh-nodejs10-nodejs (Red Hat package): before 10.10.0-3.el7
External linkshttp://access.redhat.com/errata/RHBA-2019:0772
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
