SB2017071429 - Fedora EPEL 7 update for nodejs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017071429

SB2017071429 - Fedora EPEL 7 update for nodejs

Published: July 14, 2017 Updated: April 24, 2025

Security Bulletin ID SB2017071429
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2017-1000381)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and gain access to potentially sensitive data.

The vulnerability exists due to a boundary error in ares_parse_naptr_reply() function when processing NAPTR responses. A remote attacker can send a specially crafted DNS response to vulnerable application and perform denial of service attack or gain access to potentially sensitive data.


2) Input validation error (CVE-ID: CVE-2017-11499)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.


Remediation

Install update from vendor's website.

References