http://advisories.mageia.org/MGASA-2014-0516.html

http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/

61260

MDVSA-2015:142

http://www-01.ibm.com/support/docview.wss?uid=swg21684769

https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356

Updated nodejs package fixes security vulnerabilities :

A memory corruption vulnerability, which results in a denial-of-service, was identified in the versions of V8 that ship with Node.js 0.8 and 0.10. In certain circumstances, a particularly deep recursive workload that may trigger a GC and receive an interrupt may overflow the stack and result in a segmentation fault. For instance, if your work load involves successive JSON.parse calls and the parsed objects are significantly deep, you may experience the process aborting while parsing (CVE-2014-5256).

Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Node.js before 0.10.31, allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2013-6668).

The nodejs package has been updated to version 0.10.33 to fix these issues as well as several other bugs.

CVE-2014-5256

medium

Tenable Plugins

high