Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update

Fixed packages 14

Vulnerabilities 4

• Unscored —
  CVE-2016-1669

  The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does no…

  chromium-browser oxide-qt nodejs libv8-3.14 Debian Ubuntu
  May 14, 2016
• Unscored —
  CVE-2016-5180 Public exploit

  Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cau…

  nodejs c-ares c-ares c-ares Debian Ubuntu Alpine
  Oct 3, 2016
• Unscored —
  CVE-2016-5325

  CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0…

  nodejs nodejs Debian Ubuntu
  Oct 10, 2016
• Unscored —
  CVE-2016-7099

  The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x…

  nodejs nodejs Debian Ubuntu
  Oct 10, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1335449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1346910
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1379921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1380463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1388097
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0002.json
• report
  https://access.redhat.com/security/cve/CVE-2016-1669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-1669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-1669
• article
  http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html
• report
  https://access.redhat.com/security/cve/CVE-2016-5180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-5180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-5180
• article
  https://c-ares.haxx.se/adv_20160929.html
• report
  https://access.redhat.com/security/cve/CVE-2016-5325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-5325
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-5325
• article
  https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2016-7099
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-7099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-7099