{"affected":[{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:OpenStack Cloud 7","name":"nodejs-common","purl":"pkg:rpm/suse/nodejs-common&distro=SUSE%20OpenStack%20Cloud%207"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0-2.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:OpenStack Cloud 7","name":"nodejs6","purl":"pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%207"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs4-devel":"4.8.4-15.5.1","nodejs4-docs":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1","nodejs6-devel":"6.11.1-11.5.1","nodejs6-docs":"6.11.1-11.5.1","npm4":"4.8.4-15.5.1","npm6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","name":"nodejs-common","purl":"pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0-2.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs4-devel":"4.8.4-15.5.1","nodejs4-docs":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1","nodejs6-devel":"6.11.1-11.5.1","nodejs6-docs":"6.11.1-11.5.1","npm4":"4.8.4-15.5.1","npm6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","name":"nodejs4","purl":"pkg:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.8.4-15.5.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs4-devel":"4.8.4-15.5.1","nodejs4-docs":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1","nodejs6-devel":"6.11.1-11.5.1","nodejs6-docs":"6.11.1-11.5.1","npm4":"4.8.4-15.5.1","npm6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","name":"nodejs6","purl":"pkg:rpm/suse/nodejs6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Enterprise Storage 4","name":"nodejs-common","purl":"pkg:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%204"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0-2.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Enterprise Storage 4","name":"nodejs4","purl":"pkg:rpm/suse/nodejs4&distro=SUSE%20Enterprise%20Storage%204"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.8.4-15.5.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"nodejs-common":"1.0-2.1","nodejs4":"4.8.4-15.5.1","nodejs6":"6.11.1-11.5.1"}]},"package":{"ecosystem":"SUSE:Enterprise Storage 4","name":"nodejs6","purl":"pkg:rpm/suse/nodejs6&distro=SUSE%20Enterprise%20Storage%204"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for nodejs4 and nodejs6 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory\n  outside of the given input buffer if the passed in DNS response packet was crafted in a\n  particular way. (bsc#1044946)\n- CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same\n  for all runs of the binary. This opens node up to collision attacks which could result in a Denial\n  of Service. We have temporarily disabled snapshots until a more robust solution is found.\n  (bsc#1048299)\n\nNon-security fixes:\n\n- GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)\n- New upstream LTS release 6.11.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1\n- New upstream LTS release 6.11.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0\n- New upstream LTS release 6.10.3\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3\n- New upstream LTS release 6.10.2\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2\n- New upstream LTS release 6.10.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1\n- New upstream LTS release 6.10.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0\n\n- New upstream LTS release 4.8.4\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4\n- New upstream LTS release 4.8.3\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3\n- New upstream LTS release 4.8.2\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2\n- New upstream LTS release 4.8.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1\n- New upstream LTS release 4.8.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0\n","id":"SUSE-SU-2017:2168-1","modified":"2017-08-15T12:27:34Z","published":"2017-08-15T12:27:34Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1041282"},{"type":"REPORT","url":"https://bugzilla.suse.com/1041283"},{"type":"REPORT","url":"https://bugzilla.suse.com/1044946"},{"type":"REPORT","url":"https://bugzilla.suse.com/1048299"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-1000381"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-11499"}],"related":["CVE-2017-1000381","CVE-2017-11499"],"summary":"Security update for nodejs4, nodejs6","upstream":["CVE-2017-1000381","CVE-2017-11499"]}