Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

openSUSE 42.1: Important Nodejs Security Update for 2016:1566-1

opensuse
Calendar Grey June 14, 2016
Scroller Opensuse
A significant openSUSE enhancement targets vulnerabilities in nodejs, providing solutions for memory mishandling and service disruption.
An update that fixes 5 vulnerabilities is now available

Description

This update for nodejs to version 4.4.5 fixes the several issues.

These security issues introduced by the bundled openssl were fixed by

going to version 1.0.2h:

- CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider

memory allocation during a certain padding check, which allowed remote

attackers to obtain sensitive cleartext information via a padding-oracle

attack against an AES CBC session (bsc#977616).

- CVE-2016-2105: Integer overflow in the EVP_EncodeUpdate function in

crypto/evp/encode.c in OpenSSL allowed remote attackers to cause a

denial of service (heap memory corruption) via a large amount of binary

data (bsc#977614).

- CVE-2016-0705: Double free vulnerability in the dsa_priv_decode function

in crypto/dsa/dsa_ameth.c in OpenSSL allowed remote attackers to cause a

denial of service (memory corruption) or possibly have unspecified other

impact via a malformed DSA private key (bsc#968047).

-...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service memory corruption important update openSUSE nodejs

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-715=1

- openSUSE 13.2:

zypper in -t patch openSUSE-2016-715=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.1 (i586 x86_64):

nodejs-4.4.5-27.1

nodejs-debuginfo-4.4.5-27.1

nodejs-debugsource-4.4.5-27.1

nodejs-devel-4.4.5-27.1

npm-4.4.5-27.1

- openSUSE Leap 42.1 (noarch):

nodejs-docs-4.4.5-27.1

- openSUSE 13.2 (i586 x86_64):

nodejs-4.4.5-18.1

nodejs-debuginfo-4.4.5-18.1

nodejs-debugsource-4.4.5-18.1

nodejs-devel-4.4.5-18.1

- openSUSE 13.2 (noarch):

nodejs-doc-4.4.5-18.1

References

https://www.suse.com/security/cve/CVE-2016-0702.html

https://www.suse.com/security/cve/CVE-2016-0705.html

https://www.suse.com/security/cve/CVE-2016-0797.html

https://www.suse.com/security/cve/CVE-2016-2105.html

https://www.suse.com/security/cve/CVE-2016-2107.html

https://bugzilla.suse.com/968047

https://bugzilla.suse.com/968048

https://bugzilla.suse.com/968050

https://bugzilla.suse.com/977614

https://bugzilla.suse.com/977616

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1566-1
Rating: important
Affected Products: openSUSE Leap 42.1 openSUSE 13.2 .

Topics%20covered

Topics Covered

security advisory denial of service memory corruption important update openSUSE nodejs

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.