VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Jul 9, 2015· Updated May 6, 2026

CVE-2015-5380

CVE-2015-5380

Description

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.

Affected products

12
  • Google/V8
    cpe:2.3:a:google:v8:-:*:*:*:*:*:*:*
  • Iojs/Io.js10 versions
    cpe:2.3:a:iojs:io.js:*:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:iojs:io.js:*:*:*:*:*:*:*:*range: <=1.8.2
    • cpe:2.3:a:iojs:io.js:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:iojs:io.js:2.3.2:*:*:*:*:*:*:*
  • Node.js/Node.js
    cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
    Range: <=0.12.5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.