Mandriva Linux Security Advisory : nodejs (MDVSA-2015:142)
high Nessus Plugin ID 82395
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Mandriva Linux host is missing a security update.Description
Updated nodejs package fixes security vulnerabilities :A memory corruption vulnerability, which results in a denial-of-service, was identified in the versions of V8 that ship with Node.js 0.8 and 0.10. In certain circumstances, a particularly deep recursive workload that may trigger a GC and receive an interrupt may overflow the stack and result in a segmentation fault. For instance, if your work load involves successive JSON.parse calls and the parsed objects are significantly deep, you may experience the process aborting while parsing (CVE-2014-5256).
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Node.js before 0.10.31, allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2013-6668).
The nodejs package has been updated to version 0.10.33 to fix these issues as well as several other bugs.
Solution
Update the affected nodejs package.See Also
Plugin Details
Severity: High
ID: 82395
File Name: mandriva_MDVSA-2015-142.nasl
Version: 1.4
Type: local
Family: Mandriva Local Security Checks
Published: 3/30/2015
Updated: 1/14/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:nodejs, cpe:/o:mandriva:business_server:2
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Patch Publication Date: 3/29/2015
Reference Information
CVE: CVE-2013-6668, CVE-2014-5256
MDVSA: 2015:142