CVE-2018-7166 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-7166 Interim 1 16 2024-07-27T00:34:49Z current 2021-05-30T14:11:03Z 2024-07-27T00:34:49Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-7166 In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Server for SAP Applications 15 SP1 nodejs10 nodejs10-devel nodejs10-docs nodejs12 nodejs12-devel nodejs12-docs nodejs8 nodejs8-devel nodejs8-docs npm10 npm12 npm8 nodejs8 as a component of SUSE CaaS Platform 4.0 nodejs8-devel as a component of SUSE CaaS Platform 4.0 nodejs8-docs as a component of SUSE CaaS Platform 4.0 npm8 as a component of SUSE CaaS Platform 4.0 nodejs10 as a component of SUSE Enterprise Storage 6 nodejs8 as a component of SUSE Enterprise Storage 6 nodejs8 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS nodejs8-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS nodejs8-docs as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS npm8 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS nodejs10 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs10-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs10-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm10 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm12 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs8 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8-docs as a component of SUSE Linux Enterprise Server 15 SP1-LTSS npm8 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS nodejs8 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8-devel as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8-docs as a component of SUSE Linux Enterprise Server 15-LTSS npm8 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 nodejs8-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 nodejs8-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 npm8 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information. CVE-2018-7166 SUSE CaaS Platform 4.0:nodejs8 SUSE CaaS Platform 4.0:nodejs8-devel SUSE CaaS Platform 4.0:nodejs8-docs SUSE CaaS Platform 4.0:npm8 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nodejs8 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nodejs8-devel SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:nodejs8-docs SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:npm8 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs SUSE Linux Enterprise Module for Web and Scripting 12:npm12 SUSE Linux Enterprise Server 15 SP1-LTSS:nodejs8 SUSE Linux Enterprise Server 15 SP1-LTSS:nodejs8-devel SUSE Linux Enterprise Server 15 SP1-LTSS:nodejs8-docs SUSE Linux Enterprise Server 15 SP1-LTSS:npm8 SUSE Linux Enterprise Server 15-LTSS:nodejs8 SUSE Linux Enterprise Server 15-LTSS:nodejs8-devel SUSE Linux Enterprise Server 15-LTSS:nodejs8-docs SUSE Linux Enterprise Server 15-LTSS:npm8 SUSE Linux Enterprise Server for SAP Applications 15 SP1:nodejs8 SUSE Linux Enterprise Server for SAP Applications 15 SP1:nodejs8-devel SUSE Linux Enterprise Server for SAP Applications 15 SP1:nodejs8-docs SUSE Linux Enterprise Server for SAP Applications 15 SP1:npm8 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N