CVE-2014-9748 The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to caus...
HighCVSS 8.1
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nodejs(Debian:12) | < 4.0.0~dfsg-1 | 4.0.0~dfsg-1 |
| debian/nodejs(Debian:13) | < 4.0.0~dfsg-1 | 4.0.0~dfsg-1 |
| debian/nodejs(Debian:14) | < 4.0.0~dfsg-1 | 4.0.0~dfsg-1 |
| libuv | < 1.7.4 | 1.7.4 |
| nodejs node.js | >= 0.10.0, < 0.10.46 | 0.10.46 |
| nodejs node.js | >= 0.12.0, < 0.12.15 | 0.12.15 |
References
- Debian Security Tracker CVE-2014-9748 vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- groups.google.com