Fedora EPEL 7 update for nodejs



| Updated: 2025-04-24
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2017-1000381
CVE-2017-11499
CWE-ID CWE-125
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

nodejs
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU7563

Risk: Medium

CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-1000381

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and gain access to potentially sensitive data.

The vulnerability exists due to a boundary error in ares_parse_naptr_reply() function when processing NAPTR responses. A remote attacker can send a specially crafted DNS response to vulnerable application and perform denial of service attack or gain access to potentially sensitive data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

nodejs: before 6.11.1-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-93f422baa0


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU38646

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-11499

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 7

nodejs: before 6.11.1-1.el7

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-93f422baa0


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###