SUSE-SU-2017:2168-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2017:2168-1

Related

Published

2017-08-15T12:27:34Z

Modified

2017-08-15T12:27:34Z

Summary

Security update for nodejs4, nodejs6

Details

This update for nodejs4 and nodejs6 fixes the following issues:

Security issues fixed:

CVE-2017-1000381: The c-ares function aresparsenaptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946)
CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299)

Non-security fixes:

GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)
New upstream LTS release 6.11.1
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1
New upstream LTS release 6.11.0
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0
New upstream LTS release 6.10.3
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3
New upstream LTS release 6.10.2
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2
New upstream LTS release 6.10.1
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1
New upstream LTS release 6.10.0
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0
New upstream LTS release 4.8.4
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4
New upstream LTS release 4.8.3
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3
New upstream LTS release 4.8.2
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2
New upstream LTS release 4.8.1
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1
New upstream LTS release 4.8.0
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0

References

Affected packages

SUSE:OpenStack Cloud 7 / nodejs-common

Package

Name: nodejs-common
Purl: purl:rpm/suse/nodejs-common&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0-2.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:OpenStack Cloud 7 / nodejs6

Package

Name: nodejs6
Purl: purl:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.11.1-11.5.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Web and Scripting 12 / nodejs-common

Package

Name: nodejs-common
Purl: purl:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0-2.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "npm4": "4.8.4-15.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Web and Scripting 12 / nodejs4

Package

Name: nodejs4
Purl: purl:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.8.4-15.5.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "npm4": "4.8.4-15.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Web and Scripting 12 / nodejs6

Package

Name: nodejs6
Purl: purl:rpm/suse/nodejs6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.11.1-11.5.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "npm4": "4.8.4-15.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / nodejs-common

Package

Name: nodejs-common
Purl: purl:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0-2.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / nodejs4

Package

Name: nodejs4
Purl: purl:rpm/suse/nodejs4&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.8.4-15.5.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / nodejs6

Package

Name: nodejs6
Purl: purl:rpm/suse/nodejs6&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.11.1-11.5.1

Ecosystem specific

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs4": "4.8.4-15.5.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}