Security update for nodejs4, nodejs6 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:2179-1 Final 1 1 2017-08-16T18:49:02Z current 2017-08-16T18:49:02Z 2017-08-16T18:49:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs4, nodejs6 This update for nodejs4 and nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946) - CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299) Non-security fixes: - GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282) - New upstream LTS release 6.11.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1 - New upstream LTS release 6.11.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0 - New upstream LTS release 6.10.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3 - New upstream LTS release 6.10.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2 - New upstream LTS release 6.10.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1 - New upstream LTS release 6.10.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0 - New upstream LTS release 4.8.4 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4 - New upstream LTS release 4.8.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3 - New upstream LTS release 4.8.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2 - New upstream LTS release 4.8.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1 - New upstream LTS release 4.8.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0 This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-08/msg00061.html E-Mail link for openSUSE-SU-2017:2179-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 openSUSE Leap 42.3 nodejs-common-1.0-2.1 nodejs4-4.8.4-8.1 nodejs4-devel-4.8.4-8.1 nodejs4-docs-4.8.4-8.1 nodejs6-6.11.1-3.1 nodejs6-devel-6.11.1-3.1 nodejs6-docs-6.11.1-3.1 npm4-4.8.4-8.1 npm6-6.11.1-3.1 nodejs-common-1.0-2.1 as a component of openSUSE Leap 42.2 nodejs4-4.8.4-8.1 as a component of openSUSE Leap 42.2 nodejs4-devel-4.8.4-8.1 as a component of openSUSE Leap 42.2 nodejs4-docs-4.8.4-8.1 as a component of openSUSE Leap 42.2 nodejs6-6.11.1-3.1 as a component of openSUSE Leap 42.2 nodejs6-devel-6.11.1-3.1 as a component of openSUSE Leap 42.2 nodejs6-docs-6.11.1-3.1 as a component of openSUSE Leap 42.2 npm4-4.8.4-8.1 as a component of openSUSE Leap 42.2 npm6-6.11.1-3.1 as a component of openSUSE Leap 42.2 nodejs-common-1.0-2.1 as a component of openSUSE Leap 42.3 nodejs4-4.8.4-8.1 as a component of openSUSE Leap 42.3 nodejs4-devel-4.8.4-8.1 as a component of openSUSE Leap 42.3 nodejs4-docs-4.8.4-8.1 as a component of openSUSE Leap 42.3 nodejs6-6.11.1-3.1 as a component of openSUSE Leap 42.3 nodejs6-devel-6.11.1-3.1 as a component of openSUSE Leap 42.3 nodejs6-docs-6.11.1-3.1 as a component of openSUSE Leap 42.3 npm4-4.8.4-8.1 as a component of openSUSE Leap 42.3 npm6-6.11.1-3.1 as a component of openSUSE Leap 42.3 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. CVE-2017-1000381 openSUSE Leap 42.2:nodejs-common-1.0-2.1 openSUSE Leap 42.2:nodejs4-4.8.4-8.1 openSUSE Leap 42.2:nodejs4-devel-4.8.4-8.1 openSUSE Leap 42.2:nodejs4-docs-4.8.4-8.1 openSUSE Leap 42.2:nodejs6-6.11.1-3.1 openSUSE Leap 42.2:nodejs6-devel-6.11.1-3.1 openSUSE Leap 42.2:nodejs6-docs-6.11.1-3.1 openSUSE Leap 42.2:npm4-4.8.4-8.1 openSUSE Leap 42.2:npm6-6.11.1-3.1 openSUSE Leap 42.3:nodejs-common-1.0-2.1 openSUSE Leap 42.3:nodejs4-4.8.4-8.1 openSUSE Leap 42.3:nodejs4-devel-4.8.4-8.1 openSUSE Leap 42.3:nodejs4-docs-4.8.4-8.1 openSUSE Leap 42.3:nodejs6-6.11.1-3.1 openSUSE Leap 42.3:nodejs6-devel-6.11.1-3.1 openSUSE Leap 42.3:nodejs6-docs-6.11.1-3.1 openSUSE Leap 42.3:npm4-4.8.4-8.1 openSUSE Leap 42.3:npm6-6.11.1-3.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-08/msg00061.html https://www.suse.com/security/cve/CVE-2017-1000381.html CVE-2017-1000381 https://bugzilla.suse.com/1044946 SUSE Bug 1044946 Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. CVE-2017-11499 openSUSE Leap 42.2:nodejs-common-1.0-2.1 openSUSE Leap 42.2:nodejs4-4.8.4-8.1 openSUSE Leap 42.2:nodejs4-devel-4.8.4-8.1 openSUSE Leap 42.2:nodejs4-docs-4.8.4-8.1 openSUSE Leap 42.2:nodejs6-6.11.1-3.1 openSUSE Leap 42.2:nodejs6-devel-6.11.1-3.1 openSUSE Leap 42.2:nodejs6-docs-6.11.1-3.1 openSUSE Leap 42.2:npm4-4.8.4-8.1 openSUSE Leap 42.2:npm6-6.11.1-3.1 openSUSE Leap 42.3:nodejs-common-1.0-2.1 openSUSE Leap 42.3:nodejs4-4.8.4-8.1 openSUSE Leap 42.3:nodejs4-devel-4.8.4-8.1 openSUSE Leap 42.3:nodejs4-docs-4.8.4-8.1 openSUSE Leap 42.3:nodejs6-6.11.1-3.1 openSUSE Leap 42.3:nodejs6-devel-6.11.1-3.1 openSUSE Leap 42.3:nodejs6-docs-6.11.1-3.1 openSUSE Leap 42.3:npm4-4.8.4-8.1 openSUSE Leap 42.3:npm6-6.11.1-3.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-08/msg00061.html https://www.suse.com/security/cve/CVE-2017-11499.html CVE-2017-11499 https://bugzilla.suse.com/1044849 SUSE Bug 1044849 https://bugzilla.suse.com/1048299 SUSE Bug 1048299 https://bugzilla.suse.com/1051117 SUSE Bug 1051117