Mandriva Linux Security Advisory : nodejs (MDVSA-2015:142)

high Nessus Plugin ID 82395

Language:

Synopsis

The remote Mandriva Linux host is missing a security update.

Description

Updated nodejs package fixes security vulnerabilities :

A memory corruption vulnerability, which results in a denial-of-service, was identified in the versions of V8 that ship with Node.js 0.8 and 0.10. In certain circumstances, a particularly deep recursive workload that may trigger a GC and receive an interrupt may overflow the stack and result in a segmentation fault. For instance, if your work load involves successive JSON.parse calls and the parsed objects are significantly deep, you may experience the process aborting while parsing (CVE-2014-5256).

Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Node.js before 0.10.31, allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2013-6668).

The nodejs package has been updated to version 0.10.33 to fix these issues as well as several other bugs.

Solution

Update the affected nodejs package.

Plugin Details

Severity: High

ID: 82395

File Name: mandriva_MDVSA-2015-142.nasl

Version: 1.4

Type: local

Family: Mandriva Local Security Checks

Published: 3/30/2015

Updated: 1/14/2021

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:nodejs, cpe:/o:mandriva:business_server:2

Required KB Items: Host/local_checks_enabled, Host/Mandrake/rpm-list, Host/cpu, Host/Mandrake/release

Patch Publication Date: 3/29/2015

Reference Information

CVE: CVE-2013-6668, CVE-2014-5256

MDVSA: 2015:142