Skip to content

Remote Memory Exposure in floody

Moderate severity GitHub Reviewed Published Jun 4, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm floody (npm)

Affected versions

< 0.1.1

Patched versions

0.1.1

Description

Versions of floody before 0.1.1 are vulnerable to remote memory exposure.

.write(number)in the affectedfloody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.

Proof of Concept:

var f = require('floody')(process.stdout); 
f.write(USERSUPPLIEDINPUT); 
'f.stop();


## Recommendation

Update to version 0.1.1 or later.
### References
- https://github.com/soldair/node-floody/commit/6c44722312131f4ac8a1af40f0f861c85efe01b0
- https://www.npmjs.com/advisories/601
- https://snyk.io/vuln/npm:floody:20160115
Reviewed Jun 4, 2019
Published to the GitHub Advisory Database Jun 4, 2019
Last updated Jan 9, 2023

Severity

Moderate
5.1
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-3p92-886g-qxpq

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.