Most recent entries from all

ALSA-2020:0579 — Important: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

* npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2019-04689

BREW-node-CVE-2019-16777 — npm Vulnerable to Global node_modules Binary Overwrite

Affected: Homebrew: node

Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations.

For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.

This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

## Recommendation

Upgrade to version 6.13.4 or later.

certfr-2024-avi-0575 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent…

certfr-2024-avi-0575

cnvd-2019-45390

EUVD-2026-57937

fkie_cve-2019-16777

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

GHSA-4328-8hgf-7wjr — npm Vulnerable to Global node_modules Binary Overwrite

Affected: npm: npm

This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

## Recommendation

Upgrade to version 6.13.4 or later.

gsd-2019-16777

openSUSE-SU-2020:0059-1 — Security update for nodejs8

Security update for nodejs8

RHSA-2020:0573 — Red Hat Security Advisory: nodejs:10 security update

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string nodejs: HTTP request smuggling using malformed Transfer-Encoding header nodejs: HTTP header values do not have trailing optional whitespace trimmed npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

SUSE-SU-2020:0043-1 — Security update for nodejs8

Security update for nodejs8

UBUNTU-CVE-2019-16777

Affected: Ubuntu:14.04:LTS: npm, Ubuntu:Pro:16.04:LTS: npm, Ubuntu:Pro:18.04:LTS: npm, Ubuntu:20.04:LTS: npm, Ubuntu:22.04:LTS: npm, Ubuntu:24.04:LTS: npm, Ubuntu:25.10: npm, Ubuntu:26.04:LTS: npm

WID-SEC-W-2024-1591 — Juniper JUNOS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.