Red Hat Security AdvisoryRHSA-2017:0002
rh-nodejs4-nodejs and rh-nodejs4-http-parser security update
Released 2017-01-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-nodejs4-http-parser-2.7.0-2.el6, rh-nodejs4-http-parser-devel-2.7.0-2.el6, rh-nodejs4-nodejs-4.6.2-4.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs4-http-parser-2.7.0-2.el7, rh-nodejs4-http-parser-devel-2.7.0-2.el7, rh-nodejs4-nodejs-4.6.2-4.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-nodejs4-http-parser-2.7.0-2.el6, rh-nodejs4-http-parser-devel-2.7.0-2.el6, rh-nodejs4-nodejs-4.6.2-4.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) rh-nodejs4-http-parser-2.7.0-2.el7, rh-nodejs4-http-parser-devel-2.7.0-2.el7, rh-nodejs4-nodejs-4.6.2-4.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) rh-nodejs4-http-parser-2.7.0-2.el7, rh-nodejs4-http-parser-devel-2.7.0-2.el7, rh-nodejs4-nodejs-4.6.2-4.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-nodejs4-http-parser-2.7.0-2.el7, rh-nodejs4-http-parser-devel-2.7.0-2.el7, rh-nodejs4-nodejs-4.6.2-4.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-nodejs4-http-parser-2.7.0-2.el6, rh-nodejs4-http-parser-devel-2.7.0-2.el6, rh-nodejs4-nodejs-4.6.2-4.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs4-http-parser-2.7.0-2.el7, rh-nodejs4-http-parser-devel-2.7.0-2.el7, rh-nodejs4-nodejs-4.6.2-4.el7 +2
Fixes 4 records
Priority MEDIUM 53
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with a…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08653 · Published 2016-10-03 · Partial fix CWE-787
Priority MEDIUM 45
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to caus…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04262 · Published 2016-05-14 · Partial fix CWE-119
Priority LOW 34
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP heade…
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04093 · Published 2016-10-10 · Partial fix CWE-113
Priority LOW 32
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows m…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02841 · Published 2016-10-10 · Partial fix CWE-19
THREATIST.IORead the docs