Path to this page:
Subject: CVS commit: pkgsrc/lang/nodejs4
From: Filip Hajny
Date: 2017-07-11 21:16:46
Message id: 20170711191647.01E77FACB@cvs.NetBSD.org
Log Message:
Update lang/nodejs4 to 4.8.4.
- Disable V8 snapshots - The hashseed embedded in the snapshot is
currently the same for all runs of the binary. This opens node up to
collision attacks which could result in a Denial of Service. We have
temporarily disabled snapshots until a more robust solution is found
- CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which
is used for parsing NAPTR responses, could be triggered to read memory
outside of the given input buffer if the passed in DNS response packet
was crafted in a particular way. This patch checks that there is
enough data for the required elements of an NAPTR record (2 int16, 3
bytes for string lengths) before processing a record.
Files: