vulnerability

FreeBSD: VID-bea84a7a-e0c9-11e7-b4f3-11baa0c2df21 (CVE-2017-15897): node.js -- Data Confidentiality/Integrity Vulnerability, December 2017

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

Published

Dec 14, 2017

Added

Dec 14, 2017

Modified

Jun 15, 2026

Description

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Solutions

freebsd-upgrade-package-node4freebsd-upgrade-package-node6freebsd-upgrade-package-node8freebsd-upgrade-package-node

References

CVE-2017-15897
https://attackerkb.com/topics/CVE-2017-15897
CWE-665
EUVD-EUVD-2017-7316
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7316

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report