Out-of-Bounds Read

stringstream is vulnerable to out-of-bounds read. The vulnerability exists due to a lack of validation to ensure data is not of type number. Successful exploitation leads to memory disclosure...

@cidroy/frappe-gantt (0.8.2), @hatchloyalty/hatch-lab (>=1.0.2, <=1.0.6) +47 more potentially affected by CVE-2018-21270 via stringstream (>=0.0.4, <=0.0.5)

stringstream NPM version =0.0.4, =1.0.2, =0.1.0, =1.0.3-beta, =1.1.2, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2018-21270 Source advisory: OSV:GHSA-MF6X-7MM4-X2G7...

Out-of-bounds Read in stringstream

All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module i...

GHSA-MF6X-7MM4-X2G7 Out-of-bounds Read in stringstream

All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module i...

PT-2019-10483

Name of the Vulnerable Software and Affected Versions Node.js stringstream module versions less than 0.0.6 Description The issue arises from the allocation of uninitialized buffers when a number is passed in the input stream, leading to an out-of-bounds read. This occurs when using Node.js 4.x...

Out-of-bounds Read

Overview Versions of stringstream before 0.0.6 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below. Recommendation Upgrade to version 0.0.6 or later. References - HackerOne Report -...

Denial Of Service (DoS)

stringstream is vulnerable to denial of service DoS attacks. The vulnerability exists due to the lack of validation for sane input where a large number can be entered to a stream, causing a DoS attack. In some cases, information disclosure through uninitialized memory is also possible...

Node.js third-party modules: `stringstream` allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below

I would like to report n uninitialized Buffer allocation issue in stringstream. It allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed to the stream e.g. from JSON, on Node.js 4.x and lower. Modu...