Unscored severity · published Jul 9, 2015
CVE-2015-5380
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products,…
–
CVSS
3%
EPSS
No
On KEV
Description
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
Io.js · Iojs
through 1.8.2; 2.0.0; 2.0.1; 2.0.2; 2.1.0; 2.2.0; +4 more · source: NVD
NO
Node.js · Nodejs
through 0.12.5 · source: NVD
V8
V8 · Google
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5380
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5380
Patch
http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/
www.securityfocus.com
http://www.securityfocus.com/bid/75556
codereview.chromium.org
https://codereview.chromium.org/1226493003
github.com
https://github.com/joyent/node/issues/25583
medium.com
https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852
More from V8
8.8
CVE-2026-85046
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2016-2843
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have…
8.8
CVE-2016-5129
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of…
8.8
CVE-2016-5128
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a…
8.8
CVE-2016-1678
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a…