Security update for nodejs6 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1892-1 Final 1 1 2018-07-05T15:29:53Z current 2018-07-05T15:29:53Z 2018-07-05T15:29:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs6 This update for nodejs6 to version 6.14.3 fixes the following issues: The following security vulnerability was addressed: - Fixed a denial of service (DoS) vulnerability in Buffer.fill(), which could hang when being called (CVE-2018-7167, bsc#1097375). The following other changes were made: - Use absolute paths in executable shebang lines - Fixed building with ICU61.1 (bsc#1091764) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-1287,SUSE-OpenStack-Cloud-Crowbar-8-2018-1287,SUSE-SLE-Module-Web-Scripting-12-2018-1287,SUSE-Storage-4-2018-1287 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181892-1/ Link for SUSE-SU-2018:1892-1 https://lists.suse.com/pipermail/sle-security-updates/2018-July/004249.html E-Mail link for SUSE-SU-2018:1892-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1091764 SUSE Bug 1091764 https://bugzilla.suse.com/1097375 SUSE Bug 1097375 https://www.suse.com/security/cve/CVE-2018-7167/ SUSE CVE CVE-2018-7167 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 nodejs6-6.14.3-11.15.1 nodejs6-devel-6.14.3-11.15.1 nodejs6-docs-6.14.3-11.15.1 npm6-6.14.3-11.15.1 nodejs6-6.14.3-11.15.1 as a component of SUSE Enterprise Storage 4 nodejs6-6.14.3-11.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-devel-6.14.3-11.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-docs-6.14.3-11.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm6-6.14.3-11.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-6.14.3-11.15.1 as a component of SUSE OpenStack Cloud 7 nodejs6-6.14.3-11.15.1 as a component of SUSE OpenStack Cloud Crowbar 8 Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable. CVE-2018-7167 SUSE Enterprise Storage 4:nodejs6-6.14.3-11.15.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.14.3-11.15.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.14.3-11.15.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.14.3-11.15.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.14.3-11.15.1 SUSE OpenStack Cloud 7:nodejs6-6.14.3-11.15.1 SUSE OpenStack Cloud Crowbar 8:nodejs6-6.14.3-11.15.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181892-1/ https://www.suse.com/security/cve/CVE-2018-7167.html CVE-2018-7167 https://bugzilla.suse.com/1097375 SUSE Bug 1097375