[SECURITY] Fedora 28 Update: php-zendframework-zend-diactoros-1.8.4-1.fc28

A PHP package containing implementations of the accepted PSR-7 HTTP message interfaces 1, as well as a "server" implementation similar to node's http.Server 2. Documentation: https://zendframework.github.io/zend-diactoros/ Autoloader: /usr/share/php/Zend/Diactoros/autoload.php 1...

Node.js third-party modules: [samsung-remote] Command injection

I would like to report a command injection vulnerability in the samsung-remote npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: samsung-remote version: 1.2.5 npm page: https://www.npmjs.com/package/samsung-remote Module Descriptio...

August 2018 Security Releases

August 2018 Security Releases Update 16-August-2018 Security releases available Summary Updates are now available for all active Node.js release lines. These include upgrades for OpenSSL and fixes for the vulnerabilities identified in the initial announcement below. We recommend that all users...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-3956

Summary HTTP bearer token leak in the npm package management tool Vulnerability Details CVE-ID: CVE-2016-3956 Description: npm could allow a remote attacker to obtain sensitive information, caused by the unintentional leakage of bearer tokens from the command-line interface. By setting up an HTTP...

Security Bulletin: Current Release of IBM® SDK for Node.js™ is affected by CVE-2015-0278

Summary Privilege escalation vulnerability in libuv, caused by the failure to invoke setgroups prior to calling setuid and setgid. Vulnerability Details CVE-ID: CVE-2015-0278 Description: libuv could allow a local attacker to gain elevated privileges on the system, caused by the failure to invoke...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrar...

Security Bulletin: Current Release of IBM® SDK for Node.js™ is affected by CVE-2014-7191

Summary Node.js qs denial-of-service vulnerability. Vulnerability Details CVE-ID: CVE-2014-7191 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the qs module when parsing a string representing a deeply nested object. An attacker could exploit this vulnerability to...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-4560

Summary IBM SDK for Node.js installation executables on the Windows platform are affected by CVE-2016-4560 Vulnerability Details CVEID: CVE-2016-4560 DESCRIPTION: Flexera InstallAnywhere could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search path. An...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2015-8860

Summary Denial of service vulnerability in module tar, used by the npm package management tool Vulnerability Details CVEID: CVE-2015-8860 DESCRIPTION: Node.js tar module could allow a local attacker to launch a symlink attack. Temporary files are created insecurely. A local attacker could exploit...

Security Bulletin: Vulnerabilities in OpenSSL and ReDoS vulnerability in semver module affect IBM® SDK for Node.js™ in IBM Bluemix (CVE-2016-2107, CVE-2016-2105, CVE-2015-8855)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. The "semver" module is vulnerable to regular expression denial of service ReDoS when extremely long version strings...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2015-8855

Summary Denial of service vulnerability in module semver, used by the npm package management tool Vulnerability Details CVEID: CVE-2015-8855 DESCRIPTION: The Node.js semver module is vulnerable to a denial of service, caused by an error in the regular expression implementation. An attacker could...

Security Bulletin: Vulnerabilities in zlib affect IBM® SDK for Node.js™ (CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843)

Summary zlib vulnerabilities were disclosed in December 2016 by the zlib project. zlib is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-boun...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™ (CVE-2016-2107, CVE-2016-2105)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM® SDK for Node.js™ in IBM Bluemix may be affected by CVE-2016-1669

Summary Buffer overflow in the Google V8 Javascript implementation used by IBM SDK for Node.js Vulnerability Details CVEID: CVE-2016-1669 DESCRIPTION: Google Chrome is vulnerable to a buffer overflow, caused by an error in V8. By persuading a victim to visit a specially-crafted Web site, a remote...

Security Bulletin: Vulnerability may affect IBM® SDK for Node.js™ (CVE-2017-14919)

Summary A vulnerability was disclosed in October 2017 by the Node.js project. IBM SDK for Node.js has addressed the CVE. Vulnerability Details CVEID: CVE-2017-14919 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an uncaught exception flaw in the zlib module. By making 8 an...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™ (CVE-2017-3735 CVE-2017-3736)

Summary OpenSSL vulnerabilities were disclosed on November 2, 2017 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3735 Description: OpenSSL could allow a remote attacker to obtain sensiti...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ in IBM Bluemix are affected by CVE-2016-3956, CVE-2016-2515 and CVE-2016-2537.

Summary IBM SDK for Node.js in IBM Bluemix are affected by a HTTP bearer token leak in the npm package management tool and two denial of service vulnerabilities in modules used by the npm package management tool. Vulnerability Details CVE-ID: CVE-2016-3956 Description: npm could allow a remote...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-2515 and CVE-2016-2537

Summary Two denial of service vulnerabilities in modules used by the npm package management tool Vulnerability Details CVEID: CVE-2016-2515 DESCRIPTION: Node.js hawk is vulnerable to a denial of service, caused by an error in the regular expression implementation. An attacker could exploit this...

Security Bulletin: OpenSSL vulnerability in current release of the IBM® SDK for Node.js™

Summary OpenSSL ECDSA FLUSH+RELOAD cache side-channel attack Vulnerability Details CVE ID: CVE-2014-0076 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by an implementation error in ECDSA Elliptic Curve Digital Signature Algorithm. An attacker could...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™ in IBM Cloud (CVE-2017-3736, CVE-2017-3737, CVE-2017-3738)

Summary OpenSSL vulnerabilities were disclosed on November 2, 2017 and December 7, 2017 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote...