CVE-2015-5380
Last modified
CVE-2015-5380 is a vulnerability of currently unknown severity. The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.. EPSS estimates a 3.00% chance of exploitation in the next 30 days.
Description
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| V8 | All versions | |
| Iojs | Io.Js | <= 1.8.2 |
| Iojs | Io.Js | 2.0.0 |
| Iojs | Io.Js | 2.0.1 |
| Iojs | Io.Js | 2.0.2 |
| Iojs | Io.Js | 2.1.0 |
| Iojs | Io.Js | 2.2.0 |
| Iojs | Io.Js | 2.2.1 |
| Iojs | Io.Js | 2.3.0 |
| Iojs | Io.Js | 2.3.1 |
| Iojs | Io.Js | 2.3.2 |
| Nodejs | Node.Js | <= 0.12.5 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-5380?
How severe is CVE-2015-5380?
How do I fix CVE-2015-5380?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-5374A vulnerability has been identified in Firmware variant PROF…
- CVE-2015-5375Cross-site scripting (XSS) vulnerability in unspecified dial…
- CVE-2015-5376SQL injection vulnerability in the login form in GSI WiNPAT …
- CVE-2015-5377Elasticsearch before 1.6.1 allows remote attackers to execut…
- CVE-2015-5378Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows re…
- CVE-2015-5379Cross-site scripting (XSS) vulnerability in actions.hsp in t…
- CVE-2015-5381Cross-site scripting (XSS) vulnerability in program/include/…
- CVE-2015-5382program/steps/addressbook/photo.inc in Roundcube Webmail bef…
- CVE-2015-5383Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers…
- CVE-2015-5384AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier …
- CVE-2015-5386Siemens SICAM MIC devices with firmware before 2404 allow re…
- CVE-2015-5395Cross-site request forgery (CSRF) vulnerability in SOGo befo…8.8
Are you affected by CVE-2015-5380?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST