[USN-6380-1] Node.js vulnerabilities

Severity Critical

Affected Packages 10

CVEs 6

Several security issues were fixed in Node.js.

Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-15604)

Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15605)

Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15606)

Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-8174)

It was discovered that Node.js incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2020-8265, CVE-2020-8287)

Package	Affected Version
pkg:deb/ubuntu/nodejs?distro=xenial	< 4.2.6~dfsg-1ubuntu4.2+esm2
pkg:deb/ubuntu/nodejs?distro=focal	< 10.19.0~dfsg-3ubuntu1.1
pkg:deb/ubuntu/nodejs?distro=bionic	< 8.10.0~dfsg-2ubuntu0.4+esm2
pkg:deb/ubuntu/nodejs-legacy?distro=xenial	< 4.2.6~dfsg-1ubuntu4.2+esm2
pkg:deb/ubuntu/nodejs-doc?distro=focal	< 10.19.0~dfsg-3ubuntu1.1
pkg:deb/ubuntu/nodejs-doc?distro=bionic	< 8.10.0~dfsg-2ubuntu0.4+esm2
pkg:deb/ubuntu/nodejs-dev?distro=xenial	< 4.2.6~dfsg-1ubuntu4.2+esm2
pkg:deb/ubuntu/nodejs-dev?distro=bionic	< 8.10.0~dfsg-2ubuntu0.4+esm2
pkg:deb/ubuntu/libnode64?distro=focal	< 10.19.0~dfsg-3ubuntu1.1
pkg:deb/ubuntu/libnode-dev?distro=focal	< 10.19.0~dfsg-3ubuntu1.1

ID

USN-6380-1

Severity

critical

Severity from

CVE-2019-15605

URL

https://ubuntu.com/security/notices/USN-6380-1

Published

2023-09-19T07:18:15
(12 months ago)

Modified

2023-09-19T07:18:15
(12 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/nodejs?distro=xenial	ubuntu	nodejs	< 4.2.6~dfsg-1ubuntu4.2+esm2	xenial
Affected	pkg:deb/ubuntu/nodejs?distro=focal	ubuntu	nodejs	< 10.19.0~dfsg-3ubuntu1.1	focal
Affected	pkg:deb/ubuntu/nodejs?distro=bionic	ubuntu	nodejs	< 8.10.0~dfsg-2ubuntu0.4+esm2	bionic
Affected	pkg:deb/ubuntu/nodejs-legacy?distro=xenial	ubuntu	nodejs-legacy	< 4.2.6~dfsg-1ubuntu4.2+esm2	xenial
Affected	pkg:deb/ubuntu/nodejs-doc?distro=focal	ubuntu	nodejs-doc	< 10.19.0~dfsg-3ubuntu1.1	focal
Affected	pkg:deb/ubuntu/nodejs-doc?distro=bionic	ubuntu	nodejs-doc	< 8.10.0~dfsg-2ubuntu0.4+esm2	bionic
Affected	pkg:deb/ubuntu/nodejs-dev?distro=xenial	ubuntu	nodejs-dev	< 4.2.6~dfsg-1ubuntu4.2+esm2	xenial
Affected	pkg:deb/ubuntu/nodejs-dev?distro=bionic	ubuntu	nodejs-dev	< 8.10.0~dfsg-2ubuntu0.4+esm2	bionic
Affected	pkg:deb/ubuntu/libnode64?distro=focal	ubuntu	libnode64	< 10.19.0~dfsg-3ubuntu1.1	focal
Affected	pkg:deb/ubuntu/libnode-dev?distro=focal	ubuntu	libnode-dev	< 10.19.0~dfsg-3ubuntu1.1	focal

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date