Security update for nodejs6 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:1962-1 Final 1 1 2018-07-13T17:58:27Z current 2018-07-13T17:58:27Z 2018-07-13T17:58:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs6 This update for nodejs6 to version 6.14.3 fixes the following issues: The following security vulnerability was addressed: - Fixed a denial of service (DoS) vulnerability in Buffer.fill(), which could hang when being called (CVE-2018-7167, bsc#1097375). The following other changes were made: - Use absolute paths in executable shebang lines - Fixed building with ICU61.1 (bsc#1091764) This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-07/msg00020.html E-Mail link for openSUSE-SU-2018:1962-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 nodejs6-6.14.3-12.1 nodejs6-devel-6.14.3-12.1 nodejs6-docs-6.14.3-12.1 npm6-6.14.3-12.1 nodejs6-6.14.3-12.1 as a component of openSUSE Leap 42.3 nodejs6-devel-6.14.3-12.1 as a component of openSUSE Leap 42.3 nodejs6-docs-6.14.3-12.1 as a component of openSUSE Leap 42.3 npm6-6.14.3-12.1 as a component of openSUSE Leap 42.3 Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable. CVE-2018-7167 openSUSE Leap 42.3:nodejs6-6.14.3-12.1 openSUSE Leap 42.3:nodejs6-devel-6.14.3-12.1 openSUSE Leap 42.3:nodejs6-docs-6.14.3-12.1 openSUSE Leap 42.3:npm6-6.14.3-12.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-07/msg00020.html https://www.suse.com/security/cve/CVE-2018-7167.html CVE-2018-7167 https://bugzilla.suse.com/1097375 SUSE Bug 1097375