Most recent entries from all

ALSA-2023:5360 — Important: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891)

Security Fix(es):

* nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237394)

bdu:2023-04976

certfr-2023-avi-0705 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2023-avi-0705

EUVD-2026-206311

fkie_cve-2022-25883

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

GHSA-c2qf-rxjj-qqgw — semver vulnerable to Regular Expression Denial of Service

Affected: npm: semver

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

gsd-2022-25883

msrc_CVE-2022-25883 — Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the func…

msrc_CVE-2022-25883

NCSC-2026-0034 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0034

openSUSE-SU-2024:14012-1 — system-user-velociraptor-1.0.0-9.1 on GA media

system-user-velociraptor-1.0.0-9.1 on GA media

RHSA-2023:4341 — Red Hat Security Advisory: Logging Subsystem 5.7.4 - Red Hat OpenShift bug fix and security update

nodejs-semver: Regular expression denial of service rubygem-activesupport: Regular Expression Denial of Service

UBUNTU-CVE-2022-25883

Affected: Ubuntu:Pro:14.04:LTS: node-semver, Ubuntu:Pro:16.04:LTS: node-semver, Ubuntu:18.04:LTS: node-semver, Ubuntu:20.04:LTS: node-semver, Ubuntu:22.04:LTS: node-semver, Ubuntu:24.04:LTS: node-semver, Ubuntu:25.10: node-semver, Ubuntu:26.04:LTS: node-semver

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

WID-SEC-W-2023-2356 — IBM QRadar SIEM: Mehre Schwachstellen

Ein anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.