Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.

The remote host is affected by the vulnerability described in GLSA-201612-43 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition, or       conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

This update contains nodejs 4.2.4 and fixes the following issues :

  - CVE-2015-6764: unspecified out-of-bounds access     vulnerability (boo#956902)

  - CVE-2015-8027: unspecified denial of service     vulnerability (boo#956901)

The following non-security bugs were fixed :

  - boo#948045: Nodejs 4.0 rpm does not install     addon-rpm.gypi

  - boo#961254: common.gypi should install at     /usr/share/node and npm requires nodejs-devel

Also contains all upstream bug fixes and improvements in the 4.2.2, 4.2.3 and 4.2.4 releases.

ID	Name	Product	Family	Severity
95817	GLSA-201612-43 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
88130	openSUSE Security Update : nodejs (openSUSE-2016-46)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8027

high

Tenable Plugins

high

critical

high