CVE-2016-10518

NameCVE-2016-10518
DescriptionA vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-ws (PTS)stretch1.1.0+ds1.e6ddaae4-3+deb9u1fixed
buster1.1.0+ds1.e6ddaae4-5+deb10u1fixed
bullseye7.4.2+~cs18.0.8-2fixed
bookworm8.6.0+~cs13.6.3-1fixed
sid8.8.0+~cs13.6.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-wssource(unstable)1.0.1+ds1.e6ddaae4-1unimportant

Notes

https://nodesecurity.io/advisories/67
Nodefs not covered by security support

Search for package or bug name: Reporting problems