MGASA-2019-0277

Advisory lineage Upstream: 13 Downstream: 0
Published: 15 Sept 2019, 13:24
Last modified:16 Apr 2026, 04:26

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Sept 2019, 13:24
Published
Vulnerability first disclosed
16 Apr 2026, 04:26
Last Modified
Vulnerability information updated

Description

Updated nodejs packages fix security vulnerabilities This update provides nodejs v6.17.1 fixing at least the following security issues: The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer (CVE-2017-1000381) Fix for 'path' module regular expression denial of service (CVE-2018-7158) Reject spaces in HTTP Content-Length header values (CVE-2018-7159) Fix for inspector DNS rebinding vulnerability (CVE-2018-7160) buffer: Fixes Denial of Service vulnerability where calling Buffer.fill() could hang (CVE-2018-7167) buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115) Node.js: HTTP request splitting (CVE-2018-12116) Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120) Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122) Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739) For other fixes in this update, see the referenced release logs.

Affected Systems

  • mageia•http-parser

    < 2.9.2-1.mga6

  • mageia•libuv

    < 1.16.1-1.mga6

  • mageia•nodejs

    < 6.17.1-8.mga6

References (22)