Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2020:2800-1 Critical: Nodejs8 Memory Corruption And DoS Fixes

suse
Calendar Grey September 30, 2020
Dist Suse Esm H88
SUSE announces vital patch for nodejs8 resolving various security vulnerabilities and enhancements. Ensure prompt actions are taken to safeguard your systems.
An update that solves four vulnerabilities and has two fixes is now available

Summary

This update for nodejs8 fixes the following issues: - CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443). - CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). - CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916) - CVE-2020-15095: Fixed information leak through log files (bsc#1173937). - Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686). - Add Require for nodejs8 when intalling npm8 (bsc#1172728) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

Topics%20covered

Topics Covered

security advisory information leak critical memory corruption Denial of Service SUSE nodejs8

References

#1166916 #1172442 #1172443 #1172686 #1172728

#1173937

Cross- CVE-2020-11080 CVE-2020-15095 CVE-2020-7598

CVE-2020-8174

Affected Products:

SUSE Linux Enterprise Module for Web Scripting 15-SP2

https://www.suse.com/security/cve/CVE-2020-11080.html

https://www.suse.com/security/cve/CVE-2020-15095.html

https://www.suse.com/security/cve/CVE-2020-7598.html

https://www.suse.com/security/cve/CVE-2020-8174.html

https://bugzilla.suse.com/1166916

https://bugzilla.suse.com/1172442

https://bugzilla.suse.com/1172443

https://bugzilla.suse.com/1172686

https://bugzilla.suse.com/1172728

https://bugzilla.suse.com/1173937

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:2800-1
Rating: critical

Topics%20covered

Topics Covered

security advisory information leak critical memory corruption Denial of Service SUSE nodejs8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here