Remote Memory Exposure in floody
Moderate severity
GitHub Reviewed
Published
Jun 4, 2019
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Jun 4, 2019
Published to the GitHub Advisory Database
Jun 4, 2019
Last updated
Jan 9, 2023
Versions of
floody
before 0.1.1 are vulnerable to remote memory exposure..write(number)
in the affected
floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.Proof of Concept: