Описание
Security update for nodejs6
This update for nodejs6 to version 6.14.3 fixes the following issues:
The following security vulnerability was addressed:
- Fixed a denial of service (DoS) vulnerability in Buffer.fill(), which could hang when being called (CVE-2018-7167, bsc#1097375).
The following other changes were made:
- Use absolute paths in executable shebang lines
- Fixed building with ICU61.1 (bsc#1091764)
This update was imported from the SUSE:SLE-12:Update update project.
Список пакетов
openSUSE Leap 42.3
nodejs6-6.14.3-12.1
nodejs6-devel-6.14.3-12.1
nodejs6-docs-6.14.3-12.1
npm6-6.14.3-12.1
Ссылки
- E-Mail link for openSUSE-SU-2018:1962-1
- SUSE Security Ratings
Описание
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
Затронутые продукты
openSUSE Leap 42.3:nodejs6-6.14.3-12.1
openSUSE Leap 42.3:nodejs6-devel-6.14.3-12.1
openSUSE Leap 42.3:nodejs6-docs-6.14.3-12.1
openSUSE Leap 42.3:npm6-6.14.3-12.1
Ссылки
- CVE-2018-7167
- SUSE Bug 1097375