LowFix available
Security updates for all active release lines, June 2016
Node.js published security updates for active release lines, including fixes for V8 and HTTP-processing flaws. The announcement also lists libuv-related impact and available releases.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The fixes we are including in this update are:
Node.js
Node.js v5.12.0
- Affected versions
- versions prior to v6.2.0
versions prior to v6.2.0 are affected
Node.js v5Node.js v5 is affected
Node.js v4 (LTS "Argon")Node.js v4 (LTS "Argon") is affected
Node.js v0.12 (Maintenance)Node.js v0.12 (Maintenance) is affected
Node.js v0.10 (Maintenance)Node.js v0.10 (Maintenance) is affected
- Fixed versions
- Node.js v5.12.0
Node.js v5.12.0
Node.js v4.4.6 (LTS "Argon")Node.js v4.4.6 (LTS "Argon")
Node.js v0.12.15 (Maintenance)Node.js v0.12.15 (Maintenance)
Node.js v0.10.46 (Maintenance)Node.js v0.10.46 (Maintenance)
- Prerequisites
- Not stated in this extraction
libuv
Prior to libuv version 1.7.4
- Affected versions
- Prior to libuv version 1.7.4
Prior to libuv version 1.7.4
- Fixed versions
- Not stated in this extraction
- Prerequisites
- Windows XP and Windows 2003
for Windows XP and Windows 2003
- Related CVEs
- CVE-2016-1669
CVE-2016-1669 Buffer overflow in V8
CVE-2014-9748CVE-2014-9748 Unsafe use of read/write locks on Windows 2003 and XP in libuv
CVE-2016-5325HTTP processing security defect (CVE-2016-5325)
Publisher severity
low
our assessment is that this is low severity for Node.js users
- Event
- #64586 · Revision 1
- Added to Heist Feed
- Publisher date