The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Node Core

vulnerability bulletin CVE-2019-5739

Node Core: denial of service via Keep-alive HTTP

Synthesis of the vulnerability

An attacker can trigger a fatal error via Keep-alive HTTP of Node Core, in order to trigger a denial of service.
Impacted products: IBM i, Nodejs Core, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: internet client.
Creation date: 01/03/2019.
Identifiers: CVE-2019-5739, ibm10787619, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1173-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0818-1, VIGILANCE-VUL-28633.

Description of the vulnerability

An attacker can trigger a fatal error via Keep-alive HTTP of Node Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-5737

Node Core: denial of service via Slowloris HTTP Keep-alive

Synthesis of the vulnerability

An attacker can trigger a fatal error via Slowloris HTTP Keep-alive of Node Core, in order to trigger a denial of service.
Impacted products: IBM i, Nodejs Core, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: internet client.
Creation date: 01/03/2019.
Identifiers: CVE-2019-5737, ibm10787619, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1173-1, openSUSE-SU-2019:1211-1, SUSE-SU-2019:0627-1, SUSE-SU-2019:0635-1, SUSE-SU-2019:0636-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0818-1, VIGILANCE-VUL-28632.

Description of the vulnerability

An attacker can trigger a fatal error via Slowloris HTTP Keep-alive of Node Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2019-1559

OpenSSL 1.0.2: information disclosure via 0-byte Record Padding Oracle

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Impacted products: SDS, SES, SNS, Debian, AIX, IBM i, MariaDB ~ precise, McAfee Web Gateway, MySQL Community, MySQL Enterprise, Nodejs Core, OpenSSL, openSUSE Leap, Solaris, Percona Server, SIMATIC, Slackware, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 26/02/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-080, CERTFR-2019-AVI-132, CERTFR-2019-AVI-214, cpuapr2019, CVE-2019-1559, DLA-1701-1, DSA-4400-1, ibm10876638, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1105-1, openSUSE-SU-2019:1173-1, openSUSE-SU-2019:1175-1, openSUSE-SU-2019:1432-1, SB10282, SSA:2019-057-01, SSB-439005, STORM-2019-001, SUSE-SU-2019:0572-1, SUSE-SU-2019:0600-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0803-1, SUSE-SU-2019:0818-1, TNS-2019-02, USN-3899-1, VIGILANCE-VUL-28600.

Description of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-7166

Node Core: information disclosure via Buffer.alloc

Synthesis of the vulnerability

A local attacker can read a memory fragment via Buffer.alloc() of Node Core, in order to obtain sensitive information.
Impacted products: IBM i, Nodejs Core.
Severity: 1/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 16/08/2018.
Identifiers: CVE-2018-7166, ibm10730325, VIGILANCE-VUL-27030.

Description of the vulnerability

A local attacker can read a memory fragment via Buffer.alloc() of Node Core, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2018-7164

Node.js Core: denial of service via Unused Memory

Synthesis of the vulnerability

An attacker can generate a fatal error via Unused Memory of Node.js Core, in order to trigger a denial of service.
Impacted products: IBM i, Nodejs Core.
Severity: 1/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 13/06/2018.
Identifiers: CVE-2018-7164, ibm10715995, VIGILANCE-VUL-26421.

Description of the vulnerability

An attacker can generate a fatal error via Unused Memory of Node.js Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-7162

Node.js Core: use after free via TLS

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via TLS of Node.js Core, in order to trigger a denial of service, and possibly to run code.
Impacted products: Fedora, IBM i, Nodejs Core.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: internet client.
Creation date: 13/06/2018.
Identifiers: CVE-2018-7162, FEDORA-2018-79841c871e, FEDORA-2018-f59d961d7b, ibm10715995, VIGILANCE-VUL-26420.

Description of the vulnerability

An attacker can force the usage of a freed memory area via TLS of Node.js Core, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-7161

Node.js Core: denial of service via HTTP2 Cleanup

Synthesis of the vulnerability

An attacker can generate a fatal error via HTTP2 Cleanup of Node.js Core, in order to trigger a denial of service.
Impacted products: Fedora, IBM i, IRAD, Nodejs Core, openSUSE Leap, SLES.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: internet client.
Creation date: 13/06/2018.
Identifiers: CVE-2018-7161, FEDORA-2018-79841c871e, FEDORA-2018-f59d961d7b, ibm10715995, ibm10728705, openSUSE-SU-2018:1963-1, SUSE-SU-2018:1918-1, VIGILANCE-VUL-26419.

Description of the vulnerability

An attacker can generate a fatal error via HTTP2 Cleanup of Node.js Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2018-7167

Node.js Core: denial of service via Buffer.fill

Synthesis of the vulnerability

An attacker can generate a fatal error via Buffer.fill() of Node.js Core, in order to trigger a denial of service.
Impacted products: Fedora, IBM i, Nodejs Core, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: document.
Creation date: 13/06/2018.
Identifiers: CVE-2018-7167, FEDORA-2018-79841c871e, FEDORA-2018-f59d961d7b, ibm10715995, openSUSE-SU-2018:1962-1, openSUSE-SU-2018:1963-1, SUSE-SU-2018:1892-1, SUSE-SU-2018:1918-1, VIGILANCE-VUL-26418.

Description of the vulnerability

An attacker can generate a fatal error via Buffer.fill() of Node.js Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2018-0732

OpenSSL: denial of service via Large DH Parameter

Synthesis of the vulnerability

An attacker can generate a fatal error via Large DH Parameter of OpenSSL, in order to trigger a denial of service.
Impacted products: Blue Coat CAS, ProxyAV, ProxyRA, ProxySG par Blue Coat, SGOS by Blue Coat, Debian, BIG-IP Hardware, TMOS, AIX, IBM i, Rational ClearCase, QRadar SIEM, Juniper EX-Series, Juniper J-Series, Junos OS, SRX-Series, MariaDB ~ precise, MySQL Community, MySQL Enterprise, Nodejs Core, OpenSSL, openSUSE Leap, Oracle Communications, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Solaris, Tuxedo, Oracle Virtual Directory, VirtualBox, WebLogic, Palo Alto Firewall PA***, PAN-OS, Percona Server, XtraBackup, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Symantec Content Analysis, ProxySG by Symantec, SGOS by Symantec, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, X2GoClient.
Severity: 2/4.
Consequences: denial of service on client.
Provenance: internet server.
Creation date: 12/06/2018.
Identifiers: bulletinjul2018, CERTFR-2018-AVI-511, CERTFR-2018-AVI-607, cpuapr2019, cpujan2019, cpuoct2018, CVE-2018-0732, DLA-1449-1, DSA-4348-1, DSA-4355-1, ibm10719319, ibm10729805, ibm10738401, ibm10743283, ibm10874728, JSA10919, K21665601, openSUSE-SU-2018:1906-1, openSUSE-SU-2018:2117-1, openSUSE-SU-2018:2129-1, openSUSE-SU-2018:2667-1, openSUSE-SU-2018:2695-1, openSUSE-SU-2018:2816-1, openSUSE-SU-2018:2855-1, openSUSE-SU-2018:3013-1, openSUSE-SU-2018:3015-1, PAN-SA-2018-0015, RHSA-2018:3221-01, SSA:2018-226-01, SUSE-SU-2018:1887-1, SUSE-SU-2018:1968-1, SUSE-SU-2018:2036-1, SUSE-SU-2018:2041-1, SUSE-SU-2018:2207-1, SUSE-SU-2018:2647-1, SUSE-SU-2018:2683-1, SUSE-SU-2018:2812-1, SUSE-SU-2018:2956-1, SUSE-SU-2018:2965-1, SYMSA1462, TNS-2018-14, TNS-2018-17, TSB17568, USN-3692-1, USN-3692-2, VIGILANCE-VUL-26375.

Description of the vulnerability

An attacker can generate a fatal error via Large DH Parameter of OpenSSL, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-1000168

Nghttp2: NULL pointer dereference via ALTSVC Frame

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via ALTSVC Frame of Nghttp2, in order to trigger a denial of service.
Impacted products: Fedora, IBM i, IRAD, Nodejs Core, openSUSE Leap, Solaris, SLES.
Severity: 3/4.
Consequences: denial of service on service.
Provenance: internet client.
Creation date: 23/04/2018.
Identifiers: bulletinoct2018, CVE-2018-1000168, FEDORA-2018-cec96a9c41, ibm10715995, ibm10728705, openSUSE-SU-2018:1963-1, SUSE-SU-2018:1918-1, VIGILANCE-VUL-25942.

Description of the vulnerability

An attacker can force a NULL pointer to be dereferenced via ALTSVC Frame of Nghttp2, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Node Core: