Most recent entries from all

ALSA-2019:2925 — Important: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

* HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

* HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

* HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

* HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

* HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

* HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2019-03647

Withdrawn: BELL-CVE-2019-9517 — CVE-2019-9517 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2019-avi-402 — De multiples vulnérabilités ont été découvertes dans Apache Httpd. Elles permettent à un attaquant de provoquer un prob…

certfr-2019-avi-402

Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-52970

fkie_cve-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

GHSA-w6v5-q8c8-52xx

gsd-2019-9517

openSUSE-SU-2019:2051-1 — Security update for apache2

Security update for apache2

RHSA-2019:2939 — Red Hat Security Advisory: rh-nodejs10-nodejs security update

nodejs: Denial of Service with large HTTP headers nodejs: Slowloris HTTP Denial of Service nodejs: Hostname spoofing in URL parser for javascript protocol nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service HTTP/2: flood using empty frames results in excessive resource consumption

SUSE-SU-2019:14246-1 — Security update for Mozilla Firefox

Security update for Mozilla Firefox

UBUNTU-CVE-2019-9517

Affected: Ubuntu:18.04:LTS: apache2

WID-SEC-W-2024-1591 — Juniper JUNOS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.