Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in
    Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows
    remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified
    other impact via crafted JavaScript code. (CVE-2015-6764)

  - Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a
    parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException
    and service outage) via a pipelined HTTP request. (CVE-2015-8027)

The remote host is affected by the vulnerability described in GLSA-201612-43 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition, or       conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

This update contains nodejs 4.2.4 and fixes the following issues :

  - CVE-2015-6764: unspecified out-of-bounds access     vulnerability (boo#956902)

  - CVE-2015-8027: unspecified denial of service     vulnerability (boo#956901)

The following non-security bugs were fixed :

  - boo#948045: Nodejs 4.0 rpm does not install     addon-rpm.gypi

  - boo#961254: common.gypi should install at     /usr/share/node and npm requires nodejs-devel

Also contains all upstream bug fixes and improvements in the 4.2.2, 4.2.3 and 4.2.4 releases.

ID	Name	Product	Family	Severity
401107	Alpine: multiple nodejs packages: security update to 4.2.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401107	Alpine: multiple nodejs packages: security update to 4.2.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
95817	GLSA-201612-43 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
88130	openSUSE Security Update : nodejs (openSUSE-2016-46)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8027

high

Tenable Plugins

critical

critical

high

critical

high