CVE-2014-5256

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nodejs:nodejs:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.3:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.4:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.5:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.6:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.7:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.8:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.9:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.10:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.11:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.13:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.14:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.15:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.16:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.17:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.18:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.19:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.20:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.21:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.22:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.23:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.24:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.25:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.26:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.8.27:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.2:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.3:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.4:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.5:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.6:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.7:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.8:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.9:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.10:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.11:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.12:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.13:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.14:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.15:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.16:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.17:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.18:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.19:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.20:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.21:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.22:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.23:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.24:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.25:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.26:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.27:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.28:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:nodejs:0.10.29:*:*:*:*:*:*:*

History

21 Nov 2024, 02:11

Type Values Removed Values Added
References () http://advisories.mageia.org/MGASA-2014-0516.html - () http://advisories.mageia.org/MGASA-2014-0516.html -
References () http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/ - Patch, Vendor Advisory () http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/ - Patch, Vendor Advisory
References () http://secunia.com/advisories/61260 - () http://secunia.com/advisories/61260 -
References () http://www-01.ibm.com/support/docview.wss?uid=swg21684769 - () http://www-01.ibm.com/support/docview.wss?uid=swg21684769 -
References () http://www.mandriva.com/security/advisories?name=MDVSA-2015:142 - () http://www.mandriva.com/security/advisories?name=MDVSA-2015:142 -
References () https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 - Exploit () https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 - Exploit

Information

Published : 2014-09-05 17:55

Updated : 2024-11-21 02:11


NVD link : CVE-2014-5256

Mitre link : CVE-2014-5256

CVE.ORG link : CVE-2014-5256


JSON object : View

Products Affected

nodejs

  • nodejs
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer