Mandriva Linux Security Advisory : nodejs (MDVSA-2015:142)
High Nessus Plugin ID 82395
SynopsisThe remote Mandriva Linux host is missing a security update.
DescriptionUpdated nodejs package fixes security vulnerabilities :
A memory corruption vulnerability, which results in a denial-of-service, was identified in the versions of V8 that ship with Node.js 0.8 and 0.10. In certain circumstances, a particularly deep recursive workload that may trigger a GC and receive an interrupt may overflow the stack and result in a segmentation fault. For instance, if your work load involves successive JSON.parse calls and the parsed objects are significantly deep, you may experience the process aborting while parsing (CVE-2014-5256).
Multiple unspecified vulnerabilities in Google V8 before 18.104.22.168, as used in Node.js before 0.10.31, allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2013-6668).
The nodejs package has been updated to version 0.10.33 to fix these issues as well as several other bugs.
SolutionUpdate the affected nodejs package.