Security update for nodejs4, nodejs6

SUSE Security Update: Security update for nodejs4, nodejs6
Announcement ID: SUSE-SU-2017:2168-1
Rating: moderate
References: #1041282 #1041283 #1044946 #1048299
Affected Products:
  • SUSE OpenStack Cloud 7
  • SUSE Linux Enterprise Module for Web Scripting 12
  • SUSE Enterprise Storage 4
    		•

    An update that solves two vulnerabilities and has two fixes is now available.

    Description:

    This update for nodejs4 and nodejs6 fixes the following issues:

    Security issues fixed:

    - CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be
    triggered to read memory
    outside of the given input buffer if the passed in DNS response packet
    was crafted in a particular way. (bsc#1044946)
    - CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the
    snapshot is currently the same for all runs of the binary. This opens
    node up to collision attacks which could result in a Denial
    of Service. We have temporarily disabled snapshots until a more robust
    solution is found. (bsc#1048299)

    Non-security fixes:

    - GCC 7 compilation fixes for v8 backported and add missing ICU59 headers
    (bsc#1041282)
    - New upstream LTS release 6.11.1
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .11.1
    - New upstream LTS release 6.11.0
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .11.0
    - New upstream LTS release 6.10.3
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .10.3
    - New upstream LTS release 6.10.2
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .10.2
    - New upstream LTS release 6.10.1
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .10.1
    - New upstream LTS release 6.10.0
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6
    .10.0

    - New upstream LTS release 4.8.4
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4
    .8.4
    - New upstream LTS release 4.8.3
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4
    .8.3
    - New upstream LTS release 4.8.2
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4
    .8.2
    - New upstream LTS release 4.8.1
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4
    .8.1
    - New upstream LTS release 4.8.0
    *
    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4
    .8.0

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE OpenStack Cloud 7:
      zypper in -t patch SUSE-OpenStack-Cloud-7-2017-1331=1
    • SUSE Linux Enterprise Module for Web Scripting 12:
      zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2017-1331=1
    • SUSE Enterprise Storage 4:
      zypper in -t patch SUSE-Storage-4-2017-1331=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):
      • nodejs6-6.11.1-11.5.1
      • nodejs6-debuginfo-6.11.1-11.5.1
      • nodejs6-debugsource-6.11.1-11.5.1
    • SUSE OpenStack Cloud 7 (noarch):
      • nodejs-common-1.0-2.1
    • SUSE Linux Enterprise Module for Web Scripting 12 (aarch64 ppc64le s390x x86_64):
      • nodejs6-6.11.1-11.5.1
      • nodejs6-debuginfo-6.11.1-11.5.1
      • nodejs6-debugsource-6.11.1-11.5.1
      • nodejs6-devel-6.11.1-11.5.1
      • npm6-6.11.1-11.5.1
    • SUSE Linux Enterprise Module for Web Scripting 12 (aarch64 ppc64le x86_64):
      • nodejs4-4.8.4-15.5.1
      • nodejs4-debuginfo-4.8.4-15.5.1
      • nodejs4-debugsource-4.8.4-15.5.1
      • nodejs4-devel-4.8.4-15.5.1
      • npm4-4.8.4-15.5.1
    • SUSE Linux Enterprise Module for Web Scripting 12 (noarch):
      • nodejs-common-1.0-2.1
      • nodejs4-docs-4.8.4-15.5.1
      • nodejs6-docs-6.11.1-11.5.1
    • SUSE Enterprise Storage 4 (aarch64 x86_64):
      • nodejs4-4.8.4-15.5.1
      • nodejs4-debuginfo-4.8.4-15.5.1
      • nodejs4-debugsource-4.8.4-15.5.1
      • nodejs6-6.11.1-11.5.1
      • nodejs6-debuginfo-6.11.1-11.5.1
      • nodejs6-debugsource-6.11.1-11.5.1
    • SUSE Enterprise Storage 4 (noarch):
      • nodejs-common-1.0-2.1

    References: