CVE-2017-14919

HighCVSS 7.5/10Last modified Jul 14, 2026

Description

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	CADRA	< V2511

References

http://www.securityfocus.com/bid/101881Third Party Advisory, VDB Entry
https://nodejs.org/en/blog/release/v4.8.5/Vendor Advisory
https://nodejs.org/en/blog/release/v6.11.5/Vendor Advisory
https://nodejs.org/en/blog/release/v8.8.0/Vendor Advisory
https://nodejs.org/en/blog/vulnerability/oct-2017-dos/Vendor Advisory
http://www.securityfocus.com/bid/101881Third Party Advisory, VDB Entry
https://nodejs.org/en/blog/release/v4.8.5/Vendor Advisory
https://nodejs.org/en/blog/release/v6.11.5/Vendor Advisory
https://nodejs.org/en/blog/release/v8.8.0/Vendor Advisory
https://nodejs.org/en/blog/vulnerability/oct-2017-dos/Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-470355.html

Timeline

Published: Oct 30, 2017
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-149206.1Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript CVE-2017-149215.4Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated CVE-2017-149225.4Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 al CVE-2017-149235.4Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to CVE-2017-149248.0Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b CVE-2017-149258.0Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS b CVE-2017-149265.5In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.CVE-2017-149275.5In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF docu CVE-2017-149285.5In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.CVE-2017-149297.5In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go,CVE-2017-14935.4IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper CVE-2017-149305.5Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, a