GitHub Advisoryadvisory · npm

GHSA-3p92-886g-qxpq Remote Memory Exposure in floody

MEDIUM Published 2019-06-04 Modified 2021-08-04 Official page ↗
Ecosystem
npm
Packages
floody
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201
Reviewed
2019-06-04

Affected packages

• npm floody: < 0.1.1 → fixed in 0.1.1

Description

Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure. .write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory. Proof of Concept: ``` var f = require('floody')(process.stdout); f.write(USERSUPPLIEDINPUT); 'f.stop(); Recommendation Update to version 0.1.1 or later.

Related

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References