Most recent entries from all

ALSA-2021:3623 — Important: nodejs:12 security and bug fix update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)

bdu:2022-00342

Withdrawn: BELL-CVE-2021-3672 — CVE-2021-3672 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2021-3672

Affected: Bitnami: node

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

certfr-2022-avi-216 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-216

CLEANSTART-2025-VY76861 — flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Ser…

Affected: CleanStart: c-ares

Security vulnerability affects the c-ares package. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking.

EUVD-2026-195606

fkie_cve-2021-3672

GHSA-hghm-3vc3-hppj

gsd-2021-3672

ICSA-22-069-09 — Siemens SINEC INS

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. zipfileUpdate in ext/misc/zipfile.c in SQLite…

msrc_CVE-2021-3672 — A flaw was found in c-ares library where a missing input validation check of host names returned by DNS (Domain Name Se…

msrc_CVE-2021-3672

OESA-2021-1313 — c-ares security update

Affected: openEuler:20.03-LTS-SP1: c-ares, openEuler:20.03-LTS-SP2: c-ares

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple. Security Fix(es): Missing input validation of host names returned by Domain Name Servers in the c-ares library can lead to output of wrong hostnames (leading to Domain Hijacking).(CVE-2021-3672)

openSUSE-SU-2021:1214-1 — Security update for nodejs12

Security update for nodejs12

RHSA-2021:3280 — Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

nodejs-ini: Prototype pollution via malicious INI file nodejs-glob-parent: Regular expression denial of service c-ares: Missing input validation of host names may lead to domain hijacking nodejs: Use-after-free on close http2 on stream canceling nodejs: Improper handling of untypical characters in domain names nodejs: Incomplete validation of tls rejectUnauthorized parameter nodejs: Use-after-free on close http2 on stream canceling nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

SUSE-SU-2021:14776-1 — Security update for libcares2

Security update for libcares2

UBUNTU-CVE-2021-3672

Affected: Ubuntu:Pro:16.04:LTS: c-ares, Ubuntu:18.04:LTS: c-ares, Ubuntu:20.04:LTS: c-ares, Ubuntu:22.04:LTS: c-ares

WID-SEC-W-2022-0029 — Elasticsearch und Kibana: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch und Kibana ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Administratorrechte zu erlangen.