SUSE-SU-2017:2168-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2017:2168-1
Upstream
Related
Published
2017-08-15T12:27:34Z
Modified
2026-03-11T06:36:02Z
Summary
Security update for nodejs4, nodejs6
Details

This update for nodejs4 and nodejs6 fixes the following issues:

Security issues fixed:

  • CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946)
  • CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299)

Non-security fixes:

References

Affected packages

SUSE:Enterprise Storage 4
nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
nodejs4

Package

Name
nodejs4
Purl
pkg:rpm/suse/nodejs4&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.8.4-15.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
SUSE:Linux Enterprise Module for Web and Scripting 12
nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs4-devel":  "4.8.4-15.5.1",
            "nodejs4-docs":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1",
            "nodejs6-devel":  "6.11.1-11.5.1",
            "nodejs6-docs":  "6.11.1-11.5.1",
            "npm4":  "4.8.4-15.5.1",
            "npm6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
nodejs4

Package

Name
nodejs4
Purl
pkg:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.8.4-15.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs4-devel":  "4.8.4-15.5.1",
            "nodejs4-docs":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1",
            "nodejs6-devel":  "6.11.1-11.5.1",
            "nodejs6-docs":  "6.11.1-11.5.1",
            "npm4":  "4.8.4-15.5.1",
            "npm6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs4":  "4.8.4-15.5.1",
            "nodejs4-devel":  "4.8.4-15.5.1",
            "nodejs4-docs":  "4.8.4-15.5.1",
            "nodejs6":  "6.11.1-11.5.1",
            "nodejs6-devel":  "6.11.1-11.5.1",
            "nodejs6-docs":  "6.11.1-11.5.1",
            "npm4":  "4.8.4-15.5.1",
            "npm6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
SUSE:OpenStack Cloud 7
nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"
nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "nodejs-common":  "1.0-2.1",
            "nodejs6":  "6.11.1-11.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json"