fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4863-1 advisory.

  - fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink     to a file that already exists in the system, and a file that matches the hardlink, will overwrite the     system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
    (CVE-2019-13173)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nodejs12 fixes the following issues :

Update to LTS release 12.13.0 (jsc#SLE-8947).

Security issues fixed :

CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).

CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).

CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).

CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).

CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).

CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).

CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).

CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesystem.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs6 fixes the following issues :

CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 fixes the following issues :

Security issue fixed :

  - CVE-2019-13173: Fixed a potential file overwrite via     hardlink in fstream.DirWriter() (bsc#1140290).

Non-security issue fixed :

  - Backported fixes for OpenSSL 1.1.1 from nodejs8     (bsc#1134209).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs10 to version 10.16.0 fixes the following issues :

Security issue fixed :

  - CVE-2019-13173: Fixed a potential file overwrite via     hardlink in fstream.DirWriter() (bsc#1140290).

Non-security issue fixed :

  - Update to new upstream LTS version 10.16.0, including     npm version 6.9.0 and openssl version 1.1.1b     (bsc#1134208).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs10 to version 10.16.0 fixes the following issues :

Security issue fixed :

CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).

Non-security issue fixed: Update to new upstream LTS version 10.16.0, including npm version 6.9.0 and openssl version 1.1.1b (bsc#1134208).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs8 fixes the following issues :

Security issue fixed :

CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).

Non-security issue fixed: Backported fixes for OpenSSL 1.1.1 from nodejs8 (bsc#1134209).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183578	Ubuntu 16.04 ESM : fstream vulnerability (USN-4863-1)	Nessus	Ubuntu Local Security Checks	high
132767	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:0059-1) (0-Length Headers Leak) (Data Dribble) (Empty Frames Flood) (Internal Data Buffering) (Ping Flood) (Reset Flood) (Resource Loop) (Settings Flood)	Nessus	SuSE Local Security Checks	high
128545	Ubuntu 18.04 LTS : npm/fstream vulnerability (USN-4123-1)	Nessus	Ubuntu Local Security Checks	high
128022	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:2181-1)	Nessus	SuSE Local Security Checks	high
127999	openSUSE Security Update : nodejs8 (openSUSE-2019-1907)	Nessus	SuSE Local Security Checks	high
127835	openSUSE Security Update : nodejs10 (openSUSE-2019-1846)	Nessus	SuSE Local Security Checks	high
127786	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2019:2099-1)	Nessus	SuSE Local Security Checks	high
127779	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2019:2081-1)	Nessus	SuSE Local Security Checks	high
127777	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:2078-1)	Nessus	SuSE Local Security Checks	high
127769	SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:2055-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-13173

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high