Detections
Analytics
Debian dla-4152 : libnode-dev - security update
medium Nessus Plugin ID 235077
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4152 advisory.- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4152-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaris May 02, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : nodejs Version : 12.22.12~dfsg-1~deb11u7 CVE ID : CVE-2025-47153 Debian Bug : 922075 1076350
Node.js a popular server side javascript engine was affected by a vulnerability on 32bits architecture.
Build processes for libuv and Node.js for 32-bit systems, have an inconsistent off_t size (e.g., building on i386 Debian always uses
_FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access.
Following reverse dependencies were also rebuilt in order to fix the vulnerability:
node-expat node-iconv node-leveldown node-modern-syslog node-nodedbi node-opencv node-re2 node-sqlite3 node-sass node-srs node-websocket node-zipfile r-cran-v8
For Debian 11 bullseye, this problem has been fixed in version 12.22.12~dfsg-1~deb11u7.
We recommend that you upgrade your nodejs packages.
For the detailed security status of nodejs please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/nodejs
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade the libnode-dev packages.See Also
https://security-tracker.debian.org/tracker/source-package/nodejs
Plugin Details
Severity: Medium
ID: 235077
File Name: debian_DLA-4152.nasl
Version: 1.1
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 5/1/2025
Updated: 5/1/2025
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
CVSS v2
Risk Factor: Medium
Base Score: 5.1
Temporal Score: 3.8
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2025-47153
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libnode72, p-cpe:/a:debian:debian_linux:nodejs-doc, p-cpe:/a:debian:debian_linux:libnode-dev, p-cpe:/a:debian:debian_linux:nodejs
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 5/2/2025
Vulnerability Publication Date: 5/1/2025
Reference Information
CVE: CVE-2025-47153