Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:1892-1

Опубликовано: 05 июл. 2018
Источник: suse-cvrf

Описание

Security update for nodejs6

This update for nodejs6 to version 6.14.3 fixes the following issues:

The following security vulnerability was addressed:

  • Fixed a denial of service (DoS) vulnerability in Buffer.fill(), which could hang when being called (CVE-2018-7167, bsc#1097375).

The following other changes were made:

  • Use absolute paths in executable shebang lines
  • Fixed building with ICU61.1 (bsc#1091764)

Список пакетов

SUSE Enterprise Storage 4
nodejs6-6.14.3-11.15.1
SUSE Linux Enterprise Module for Web and Scripting 12
nodejs6-6.14.3-11.15.1
nodejs6-devel-6.14.3-11.15.1
nodejs6-docs-6.14.3-11.15.1
npm6-6.14.3-11.15.1
SUSE OpenStack Cloud 7
nodejs6-6.14.3-11.15.1
SUSE OpenStack Cloud Crowbar 8
nodejs6-6.14.3-11.15.1

Ссылки

Описание

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

Затронутые продукты
SUSE Enterprise Storage 4:nodejs6-6.14.3-11.15.1
SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.14.3-11.15.1
SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.14.3-11.15.1
SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.14.3-11.15.1
Ссылки