CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

This update for nodejs4 fixes the following issues:

Security issues fixed:

• CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL (bsc#1072322).
• CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value.
• CVE-2017-3738: Embedded OpenSSL is vulnerable to rsaz_1024_mul_avx2 overflow bug on x86_64.
• CVE-2017-3736: Embedded OpenSSL is vulnerable to bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).
• CVE-2017-3735: Embedded OpenSSL is vulnerable to malformed X.509 IPAdressFamily that could cause OOB read (bsc#1056058).

Bug fixes:

• Update to release 4.8.7 (bsc#1072322):
  • https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
  • https://nodejs.org/en/blog/release/v4.8.7/
  • https://nodejs.org/en/blog/release/v4.8.6/
  • https://nodejs.org/en/blog/release/v4.8.5/

This update for nodejs6 fixes the following issues:

Security issues fixed:

• CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL (bsc#1072322).
• CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value.
• CVE-2017-3738: Embedded OpenSSL is vulnerable to rsaz_1024_mul_avx2 overflow bug on x86_64.
• CVE-2017-3736: Embedded OpenSSL is vulnerable to bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242).
• CVE-2017-3735: Embedded OpenSSL is vulnerable to malformed X.509 IPAdressFamily that could cause OOB read (bsc#1056058).

Bug fixes:

• Update to LTS release 6.12.2 (bsc#1072322):
  • https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
  • https://nodejs.org/en/blog/release/v6.12.2/
  • https://nodejs.org/en/blog/release/v6.12.1/
  • https://nodejs.org/en/blog/release/v6.12.0/
  • https://nodejs.org/en/blog/release/v6.11.5/
  • https://nodejs.org/en/blog/release/v6.11.4/
  • https://nodejs.org/en/blog/release/v6.11.3/
  • https://nodejs.org/en/blog/release/v6.11.2/

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives