#VU14498 Out-of-bounds write in Node.js - CVE-2018-12115

Vulnerability identifier: #VU14498

Vulnerability risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2018-12115

CWE-ID: CWE-787

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Node.js
Server applications / Web servers

Vendor: Node.js Foundation

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to an out-of-bounds write condition in the Buffer component when used with UCS-2 encoding. A local attacker can cause a targeted system to stop functioning or execute arbitrary code with elevated privileges.

Mitigation
The vulnerability has been fixed in the versions 6.14.4, 8.11.4 and 10.9.0.

Vulnerable software versions

Node.js: 6.0.0, 6.1.0 - 6.13.1, 6.2.0 - 6.2.2, 6.3.0 - 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.7.0, 6.8.0 - 6.8.1, 6.9.0 - 6.9.5, 8.0.0, 8.1.0 - 8.11.3, 8.2.0 - 8.2.1, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.8.0 - 8.8.1, 8.9.0 - 8.9.4, 10.0.0, 10.1.0, 10.2.0 - 10.2.1, 10.3.0, 10.4.0 - 10.4.1, 10.6.0, 10.7.0, 10.8.0

---

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.