Ubuntu alert USN-6380-1 (nodejs) [LWN.net]

admin 






From:
 
Amir Naseredini <[email protected]>




To:
 
[email protected]




Subject:
 
[USN-6380-1] Node.js vulnerabilities




Date:
 
Tue, 19 Sep 2023 11:28:19 +0200




Message-ID:
 
<[email protected]>





==========================================================================

Ubuntu Security Notice USN-6380-1

September 19, 2023



nodejs vulnerabilities

==========================================================================



A security issue affects these releases of Ubuntu and its derivatives:



– Ubuntu 20.04 LTS

– Ubuntu 18.04 LTS (Available with Ubuntu Pro)

– Ubuntu 16.04 LTS (Available with Ubuntu Pro)



Summary:



Several security issues were fixed in Node.js.



Software Description:

– nodejs: An open-source, cross-platform JavaScript runtime environment.



Details:



Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If

a user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to cause a denial

of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

(CVE-2019-15604)



Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If

a user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to obtain

sensitive information. This issue only affected Ubuntu 16.04 LTS and

Ubuntu 18.04 LTS. (CVE-2019-15605)



Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a

user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to execute

arbitrary code. This issue only affected Ubuntu 16.04 LTS and

Ubuntu 18.04 LTS. (CVE-2019-15606)



Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If

a user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to cause a

denial of service. This issue only affected Ubuntu 18.04 LTS and

Ubuntu 20.04 LTS. (CVE-2020-8174)



It was discovered that Node.js incorrectly handled certain inputs. If a user

or an automated system were tricked into opening a specially crafted input

file, a remote attacker could possibly use this issue to cause a

denial of service. (CVE-2020-8265, CVE-2020-8287)



Update instructions:



The problem can be corrected by updating your system to the following

package versions:



Ubuntu 20.04 LTS:

   libnode-dev                     10.19.0~dfsg-3ubuntu1.1

   libnode64                       10.19.0~dfsg-3ubuntu1.1

   nodejs                          10.19.0~dfsg-3ubuntu1.1



Ubuntu 18.04 LTS (Available with Ubuntu Pro):

   nodejs                          8.10.0~dfsg-2ubuntu0.4+esm2

   nodejs-dev                      8.10.0~dfsg-2ubuntu0.4+esm2



Ubuntu 16.04 LTS (Available with Ubuntu Pro):

   nodejs                          4.2.6~dfsg-1ubuntu4.2+esm2

   nodejs-dev                      4.2.6~dfsg-1ubuntu4.2+esm2

   nodejs-legacy                   4.2.6~dfsg-1ubuntu4.2+esm2



In general, a standard system update will make all the necessary changes.



References:

   ubuntu.com/security/notices/USN-6380-1

   CVE-2019-15604, CVE-2019-15605, CVE-2019-15606, CVE-2020-8174,

   CVE-2020-8265, CVE-2020-8287



Package Information:

   launchpad.net/ubuntu/+source/nodejs/10.19.0~dfsg-…





           (Log in to post comments)
           


Read more here: Source link