oss-security - node.js out of band write

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1436140297.2777045.315833937.576534B9@webmail.messagingengine.com>
Date: Sun, 05 Jul 2015 18:51:37 -0500
From: Mark Felder <feld@...d.me>
To: oss-security@...ts.openwall.com
Subject: node.js out of band write

Node has resolved a security vulnerability in their most recent release
but do not appear to have requested a CVE ID.

http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/

Node v0.12.6 (Stable)
Sat, 04 Jul 2015 02:34:23 UTC - release

This release of Node.js fixes a bug that triggers an out-of-band write
in V8's utf-8 decoder. This bug impacts all Buffer to String
conversions. This is an important security update as this bug can be
used to cause a denial of service attack.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.