CVE-2014-7192
NoneCVSS
—
EPSS
13.0%
Published
Dec 11, 2014
CISA due date
—
The record
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | syntax-error | 0 | 1.1.1 |
| Ubuntu:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:18.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libv8-3.14 | 0 | No fix |
Related vulnerabilities
- CVE-2020-6507 Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote… Also affects libv8-3.14
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects libv8-3.14
- CVE-2018-6065 Integer overflow in computing the required allocation size when instantiating a new… Also affects libv8-3.14
- CVE-2017-5115 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote… Also affects libv8-3.14
- CVE-2017-5116 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux… Also affects libv8-3.14
- CVE-2017-5098 A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… Also affects libv8-3.14
- CVE-2017-5070 Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac… Also affects libv8-3.14
- CVE-2017-5040 V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108… Also affects libv8-3.14