Subject: CVS commit: pkgsrc/lang/nodejs4
From: Filip Hajny
Date: 2017-07-11 21:16:46
Message id: 20170711191647.01E77FACB@cvs.NetBSD.org

Log Message:
Update lang/nodejs4 to 4.8.4.

- Disable V8 snapshots - The hashseed embedded in the snapshot is
  currently the same for all runs of the binary. This opens node up to
  collision attacks which could result in a Denial of Service. We have
  temporarily disabled snapshots until a more robust solution is found
- CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which
  is used for parsing NAPTR responses, could be triggered to read memory
  outside of the given input buffer if the passed in DNS response packet
  was crafted in a particular way. This patch checks that there is
  enough data for the required elements of an NAPTR record (2 int16, 3
  bytes for string lengths) before processing a record.

Files:
RevisionActionfile
1.33modifypkgsrc/lang/nodejs4/Makefile
1.29modifypkgsrc/lang/nodejs4/distinfo