SUSE-SU-2017:2168-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2168-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2017:2168-1
Upstream
Related
Published
2017-08-15T12:27:34Z
Modified
2025-05-02T04:05:59.453678Z
Summary
Security update for nodejs4, nodejs6
Details

This update for nodejs4 and nodejs6 fixes the following issues:

Security issues fixed:

  • CVE-2017-1000381: The c-ares function aresparsenaptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946)
  • CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299)

Non-security fixes:

  • GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)
  • New upstream LTS release 6.11.1
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1
  • New upstream LTS release 6.11.0
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0
  • New upstream LTS release 6.10.3
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3
  • New upstream LTS release 6.10.2
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2
  • New upstream LTS release 6.10.1
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1

  • New upstream LTS release 6.10.0

    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0

  • New upstream LTS release 4.8.4

    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4
  • New upstream LTS release 4.8.3
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3
  • New upstream LTS release 4.8.2
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2
  • New upstream LTS release 4.8.1
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1
  • New upstream LTS release 4.8.0
    • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0
References

Affected packages

SUSE:Enterprise Storage 4

nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

nodejs4

Package

Name
nodejs4
Purl
pkg:rpm/suse/nodejs4&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.8.4-15.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Web and Scripting 12

nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1",
            "npm4": "4.8.4-15.5.1"
        }
    ]
}

nodejs4

Package

Name
nodejs4
Purl
pkg:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.8.4-15.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1",
            "npm4": "4.8.4-15.5.1"
        }
    ]
}

nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs4": "4.8.4-15.5.1",
            "npm6": "6.11.1-11.5.1",
            "nodejs4-devel": "4.8.4-15.5.1",
            "nodejs4-docs": "4.8.4-15.5.1",
            "nodejs6-docs": "6.11.1-11.5.1",
            "nodejs6-devel": "6.11.1-11.5.1",
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1",
            "npm4": "4.8.4-15.5.1"
        }
    ]
}

SUSE:OpenStack Cloud 7

nodejs-common

Package

Name
nodejs-common
Purl
pkg:rpm/suse/nodejs-common&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0-2.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}

nodejs6

Package

Name
nodejs6
Purl
pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.11.1-11.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs-common": "1.0-2.1",
            "nodejs6": "6.11.1-11.5.1"
        }
    ]
}