Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gentooGentoo FoundationGLSA-201612-43
HistoryDec 13, 2016 - 12:00 a.m.

Node.js: Multiple vulnerabilities

2016-12-1300:00:00
Gentoo Foundation
security.gentoo.org
26

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.033 Low

EPSS

Percentile

91.2%

JSON

Background

Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine.

Description

Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly cause a Denial of Service condition, or conduct man-in-the-middle attacks.

Workaround

There is no known workaround at this time.

Resolution

All Node.js 0.12.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-libs/nodejs-0.12.17"

All Node.js 4.6.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-libs/nodejs-4.6.1"
OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-libs/nodejs< 4.6.1UNKNOWN

Related

nessus 11
openvas 5
mageia 2
fedora 2
ibm 15
prion 4
nodejsblog 6
cve 4
debiancve 4
ubuntucve 4
redhatcve 1
veracode 3
f5 3
apple 2
archlinux 1
redhat 2
hackerone 2
suse 3
nessus
nessus
GLSA-201612-43 : Node.js: Multiple vulnerabilities
2016-12-14 00:00:00
Fedora 22 : nodejs-0.10.42-4.fc22 (2016-8925b6119f)
2016-03-04 00:00:00
openSUSE Security Update : nodejs (openSUSE-2016-283)
2016-02-29 00:00:00
openvas
openvas
Fedora Update for nodejs FEDORA-2016-8925
2016-02-23 00:00:00
Fedora Update for nodejs FEDORA-2016-3102
2016-02-15 00:00:00
Mageia Linux Local Check: mgasa-2016-0080
2016-02-22 00:00:00
mageia
mageia
Updated nodejs packages fix security vulnerability
2016-02-19 11:40:43
Updated nodejs packages fix security vulnerability
2017-07-13 12:10:46
fedora
fedora
[SECURITY] Fedora 23 Update: nodejs-0.10.42-4.fc23
2016-02-15 02:56:03
[SECURITY] Fedora 22 Update: nodejs-0.10.42-4.fc22
2016-02-22 20:53:05
ibm
ibm
Security Bulletin: Multiple vulnerabilities in the IBM SDK for Node.js affect the Cordova tools in Rational Application Developer affecting Rational Developer for i and Rational Developer for AIX and Linux (CVE-2016-2086, CVE-2016-2216, CVE-2015-3197)
2018-08-03 04:23:43
Security Bulletin: Multiple vulnerabilities in the IBM SDK for Node.js affect the Cordova tools in IBM Rational Application Developer (CVE-2016-2086, CVE-2016-2216, CVE-2015-3197)
2020-02-05 00:09:48
Security Bulletin: Multiple vulnerabilities in current releases of IBM® SDK for Node.js™
2018-08-09 04:20:36
prion
prion
Cross site request forgery (csrf)
2016-01-02 21:59:00
Crlf injection
2016-10-10 16:59:00
Design/Logic Flaw
2016-04-07 21:59:00
nodejsblog
nodejsblog
February 2016 Security Release Summary
2016-02-09 00:00:00
CVE-2015-8027 Denial of Service Vulnerability / CVE-2015-6764 V8 Out-of-bounds Access Vulnerability
2015-11-25 00:00:00
December Security Release Schedule Update
2015-12-01 00:00:00
cve
cve
CVE-2015-8027
2016-01-02 21:59:00
CVE-2016-5325
2016-10-10 16:59:00
CVE-2016-2086
2016-04-07 21:59:00
debiancve
debiancve
CVE-2015-8027
2016-01-02 21:59:00
CVE-2016-5325
2016-10-10 16:59:00
CVE-2016-2216
2016-04-07 21:59:00
ubuntucve
ubuntucve
CVE-2015-8027
2016-01-02 00:00:00
CVE-2016-5325
2016-10-10 00:00:00
CVE-2016-2086
2016-04-07 00:00:00
redhatcve
redhatcve
CVE-2016-5325
2016-06-15 16:19:00
veracode
veracode
HTTP Response Splitting
2018-09-24 05:08:11
HTTP Request Smuggling
2018-11-20 02:28:56
Response Splitting
2018-09-24 08:49:10
f5
f5
K23134279 : Node.js vulnerability CVE-2016-2216
2017-03-20 00:00:00
K15311661 : NodeJS vulnerability CVE-2016-2086
2016-09-23 00:00:00
K24444803 : Node.js vulnerabilities CVE-2015-8860, CVE-2015-8856, CVE-2016-7099, and CVE-2016-5325
2018-10-17 00:00:00
apple
apple
About the security content of Xcode 8.1 - Apple Support
2017-01-23 05:36:06
About the security content of Xcode 8.1
2016-10-27 00:00:00
archlinux
archlinux
nodejs: multiple issues
2015-12-05 00:00:00
redhat
redhat
(RHSA-2016:2101) Moderate: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update
2016-10-27 16:28:45
(RHSA-2017:0002) Important: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update
2017-01-02 15:33:44
hackerone
hackerone
Internet Bug Bounty: Multiple HTTP Smuggling reports
2019-07-17 22:47:10
Internet Bug Bounty: Apache HTTP Request Parsing Whitespace Defects
2017-06-29 17:41:22
suse
suse
Security update for nodejs4 (important)
2016-10-06 20:14:21
Security update for nodejs4 (important)
2016-11-01 16:19:35
Security update for nodejs (important)
2016-10-11 19:20:03

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.033 Low

EPSS

Percentile

91.2%

JSON
Related for GLSA-201612-43
nessus11openvas5mageia2fedora2ibm15prion4nodejsblog6cve4debiancve4ubuntucve4redhatcve1veracode3f53apple2archlinux1redhat2hackerone2suse3