MGASA-2019-0277
- Source
- https://advisories.mageia.org/MGASA-2019-0277.html
- Import Source
- https://advisories.mageia.org/MGASA-2019-0277.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2019-0277
- Related
- Published
- 2019-09-15T13:24:16Z
- Modified
- 2022-02-17T18:21:47Z
- Summary
- Updated nodejs packages fix security vulnerabilities
- Details
-
This update provides nodejs v6.17.1 fixing at least the following security issues:
The c-ares function aresparsenaptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer (CVE-2017-1000381)
Fix for 'path' module regular expression denial of service (CVE-2018-7158)
Reject spaces in HTTP Content-Length header values (CVE-2018-7159)
Fix for inspector DNS rebinding vulnerability (CVE-2018-7160)
buffer: Fixes Denial of Service vulnerability where calling Buffer.fill() could hang (CVE-2018-7167)
buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
Node.js: HTTP request splitting (CVE-2018-12116)
Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120)
Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122)
Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)
For other fixes in this update, see the referenced release logs.
- References
-
- https://advisories.mageia.org/MGASA-2019-0277.html
- https://bugs.mageia.org/show_bug.cgi?id=21330
- https://nodejs.org/en/blog/release/v6.11.0/
- https://nodejs.org/en/blog/release/v6.11.1/
- https://nodejs.org/en/blog/release/v6.11.2/
- https://nodejs.org/en/blog/release/v6.11.3/
- https://nodejs.org/en/blog/release/v6.11.4/
- https://nodejs.org/en/blog/release/v6.12.0/
- https://nodejs.org/en/blog/release/v6.12.1/
- https://nodejs.org/en/blog/release/v6.12.2/
- https://nodejs.org/en/blog/release/v6.12.3/
- https://nodejs.org/en/blog/release/v6.13.0/
- https://nodejs.org/en/blog/release/v6.13.1/
- https://nodejs.org/en/blog/release/v6.14.0/
- https://nodejs.org/en/blog/release/v6.14.1/
- https://nodejs.org/en/blog/release/v6.14.2/
- https://nodejs.org/en/blog/release/v6.14.3/
- https://nodejs.org/en/blog/release/v6.15.0/
- https://nodejs.org/en/blog/release/v6.15.1/
- https://nodejs.org/en/blog/release/v6.16.0/
- https://nodejs.org/en/blog/release/v6.17.0/
- https://nodejs.org/en/blog/release/v6.17.1/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:6 / nodejs
Package
- Name
- nodejs
- Purl
- pkg:rpm/mageia/nodejs?distro=mageia-6
Mageia:6 / http-parser
Package
- Name
- http-parser
- Purl
- pkg:rpm/mageia/http-parser?distro=mageia-6
Mageia:6 / libuv
Package
- Name
- libuv
- Purl
- pkg:rpm/mageia/libuv?distro=mageia-6