{"id":"CVE-2018-12115","aliases":["ALPINE-CVE-2018-12115","BELL-CVE-2018-12115","DEBIAN-CVE-2018-12115","EUVD-2018-4093","GHSA-q85m-543x-pwpc","MGASA-2019-0277","RHSA-2018:2552","RHSA-2018:2553","RHSA-2018:2944","RHSA-2018:2949","RHSA-2018:3537","SUSE-SU-2018:2647-1","SUSE-SU-2018:2796-1","SUSE-SU-2018:2812-1","SUSE-SU-2019:14246-1","UBUNTU-CVE-2018-12115","USN-4796-1"],"status":"published","title":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding ...","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07779,"percentile":0.94688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-08-21T12:29:00Z","modified":"2026-10-24T10:30:20Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nodejs","fixed_in":["8.11.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["10.15.0~dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["10.15.0~dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["10.15.0~dfsg-6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs","fixed_in":["0:6.11.3-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-debuginfo","fixed_in":["0:6.11.3-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-devel","fixed_in":["0:6.11.3-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-docs","fixed_in":["0:6.11.3-6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs","fixed_in":["0:6.11.3-7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-debuginfo","fixed_in":["0:6.11.3-7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-devel","fixed_in":["0:6.11.3-7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-docs","fixed_in":["0:6.11.3-7.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","fixed_in":["8.10.0~dfsg-2ubuntu0.4+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.15.0~dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.15.0~dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.15.0~dfsg-6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-8.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.0-1.8.11.4.2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.4-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.4-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.4-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2.0-1.10.9.0.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift_application_runtimes:1.0::el7","package":"rhoar-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-nodejs6-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs6-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.4-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.4-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.4-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.4-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.0-8.11.4.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.12-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1539805268-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.43-1.git.0.647ac05.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.4-11.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.4-11.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.4-11.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.4-11.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.4-3.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.2.0-78.51.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68-21.9.8"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-atk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2.13.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.11-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-2.14.7"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.9-2.15.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-harfbuzz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.git259-2.3.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-14.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-pango","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.14-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21-29.6.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45-38.9.3"}]}],"bundled":118},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm1"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.25~dfsg2-2ubuntu1.2+esm1"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm1"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm1"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4"],"bundled":9}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node.js"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"the node.js project","product":"node.js"}],"references":[{"url":"http://www.securityfocus.com/bid/105127","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2552","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2553","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2944","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3537","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2949","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12115","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/august-2018-security-releases"},{"url":"https://github.com/advisories/GHSA-q85m-543x-pwpc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-12115","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-12115","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12115","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0277.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21330","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v6.11.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.4/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.16.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.1/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/red_hat_openshift_application_runtimes_release_notes/index#runtime_components_nodejs_rpm_packages","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1591100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1620219","tags":["report"]},{"url":"https://issues.redhat.com/browse/NODE-153","tags":["article"]},{"url":"https://issues.redhat.com/browse/NODE-154","tags":["article"]},{"url":"https://issues.redhat.com/browse/NODE-155","tags":["article"]},{"url":"https://issues.redhat.com/browse/NODE-160","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2552.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-0732","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20180612.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12115","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1620215","tags":["report"]},{"url":"https://issues.redhat.com/browse/NODE-152","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2553.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7166","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2944.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2949.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1591013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1591006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7167","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/3716411","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1613722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1614904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1615884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1626228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1626538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1627086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1627689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1629558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1637413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1637737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641245","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1641796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1643948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648138","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3537.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3830","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3830","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1002105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1002105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1002105","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-announce/GVllWCg6L88","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182647-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1091764","tags":["report"]},{"url":"https://bugzilla.suse.com/1097158","tags":["report"]},{"url":"https://bugzilla.suse.com/1097748","tags":["report"]},{"url":"https://bugzilla.suse.com/1105019","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182796-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182812-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000036","tags":["report"]},{"url":"https://bugzilla.suse.com/1001652","tags":["report"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/104105","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1043008","tags":["report"]},{"url":"https://bugzilla.suse.com/1044946","tags":["report"]},{"url":"https://bugzilla.suse.com/1047925","tags":["report"]},{"url":"https://bugzilla.suse.com/1047936","tags":["report"]},{"url":"https://bugzilla.suse.com/1048299","tags":["report"]},{"url":"https://bugzilla.suse.com/1049186","tags":["report"]},{"url":"https://bugzilla.suse.com/1050653","tags":["report"]},{"url":"https://bugzilla.suse.com/1056058","tags":["report"]},{"url":"https://bugzilla.suse.com/1058013","tags":["report"]},{"url":"https://bugzilla.suse.com/1066242","tags":["report"]},{"url":"https://bugzilla.suse.com/1066953","tags":["report"]},{"url":"https://bugzilla.suse.com/1070738","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1072320","tags":["report"]},{"url":"https://bugzilla.suse.com/1072322","tags":["report"]},{"url":"https://bugzilla.suse.com/1073796","tags":["report"]},{"url":"https://bugzilla.suse.com/1073798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073799","tags":["report"]},{"url":"https://bugzilla.suse.com/1073803","tags":["report"]},{"url":"https://bugzilla.suse.com/1073808","tags":["report"]},{"url":"https://bugzilla.suse.com/1073818","tags":["report"]},{"url":"https://bugzilla.suse.com/1073823","tags":["report"]},{"url":"https://bugzilla.suse.com/1073829","tags":["report"]},{"url":"https://bugzilla.suse.com/1073830","tags":["report"]},{"url":"https://bugzilla.suse.com/1073832","tags":["report"]},{"url":"https://bugzilla.suse.com/1073846","tags":["report"]},{"url":"https://bugzilla.suse.com/1074235","tags":["report"]},{"url":"https://bugzilla.suse.com/1077230","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1087453","tags":["report"]},{"url":"https://bugzilla.suse.com/1087459","tags":["report"]},{"url":"https://bugzilla.suse.com/1087463","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1097375","tags":["report"]},{"url":"https://bugzilla.suse.com/1097401","tags":["report"]},{"url":"https://bugzilla.suse.com/1097404","tags":["report"]},{"url":"https://bugzilla.suse.com/1104841","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1109465","tags":["report"]},{"url":"https://bugzilla.suse.com/1117473","tags":["report"]},{"url":"https://bugzilla.suse.com/1117626","tags":["report"]},{"url":"https://bugzilla.suse.com/1117627","tags":["report"]},{"url":"https://bugzilla.suse.com/1117629","tags":["report"]},{"url":"https://bugzilla.suse.com/1117630","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1123482","tags":["report"]},{"url":"https://bugzilla.suse.com/1124525","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130694","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1133810","tags":["report"]},{"url":"https://bugzilla.suse.com/1134209","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://bugzilla.suse.com/1140290","tags":["report"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1144919","tags":["report"]},{"url":"https://bugzilla.suse.com/1145665","tags":["report"]},{"url":"https://bugzilla.suse.com/1146090","tags":["report"]},{"url":"https://bugzilla.suse.com/1146091","tags":["report"]},{"url":"https://bugzilla.suse.com/1146093","tags":["report"]},{"url":"https://bugzilla.suse.com/1146094","tags":["report"]},{"url":"https://bugzilla.suse.com/1146095","tags":["report"]},{"url":"https://bugzilla.suse.com/1146097","tags":["report"]},{"url":"https://bugzilla.suse.com/1146099","tags":["report"]},{"url":"https://bugzilla.suse.com/1146100","tags":["report"]},{"url":"https://bugzilla.suse.com/1149323","tags":["report"]},{"url":"https://bugzilla.suse.com/1153423","tags":["report"]},{"url":"https://bugzilla.suse.com/1154738","tags":["report"]},{"url":"https://bugzilla.suse.com/1447070","tags":["report"]},{"url":"https://bugzilla.suse.com/1447409","tags":["report"]},{"url":"https://bugzilla.suse.com/744625","tags":["report"]},{"url":"https://bugzilla.suse.com/744629","tags":["report"]},{"url":"https://bugzilla.suse.com/845955","tags":["report"]},{"url":"https://bugzilla.suse.com/865853","tags":["report"]},{"url":"https://bugzilla.suse.com/905528","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/937414","tags":["report"]},{"url":"https://bugzilla.suse.com/947747","tags":["report"]},{"url":"https://bugzilla.suse.com/948045","tags":["report"]},{"url":"https://bugzilla.suse.com/948602","tags":["report"]},{"url":"https://bugzilla.suse.com/955142","tags":["report"]},{"url":"https://bugzilla.suse.com/957814","tags":["report"]},{"url":"https://bugzilla.suse.com/957815","tags":["report"]},{"url":"https://bugzilla.suse.com/961254","tags":["report"]},{"url":"https://bugzilla.suse.com/962297","tags":["report"]},{"url":"https://bugzilla.suse.com/966076","tags":["report"]},{"url":"https://bugzilla.suse.com/966077","tags":["report"]},{"url":"https://bugzilla.suse.com/985201","tags":["report"]},{"url":"https://bugzilla.suse.com/986541","tags":["report"]},{"url":"https://bugzilla.suse.com/991344","tags":["report"]},{"url":"https://bugzilla.suse.com/998743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12115","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4796-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5737","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T13:00:00Z","modified":"2026-10-15T17:22:34.814Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4093","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T13:00:00Z","modified":"2026-10-15T17:22:34Z","updated_at":"2026-11-02T17:00:11.901066Z"}],"ghsa":[{"id":"GHSA-q85m-543x-pwpc","title":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding ...","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2022-05-13T01:27:49Z","modified":"2026-10-15T18:32:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:36.44286Z"}],"nvd":[{"id":"CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T12:29:00.21Z","modified":"2026-10-15T18:17:11.007Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"ALPINE-CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T12:29:00.21Z","modified":"2026-10-23T17:17:55.206914576Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-12115","title":"CVE-2018-12115 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:07.671333Z","modified":"2026-02-18T07:38:20.881341Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T12:29:00.21Z","modified":"2026-10-24T10:30:20.606978267Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T12:29:00.21Z","modified":"2026-10-15T21:47:28.826805801Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:2552","title":"Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Node.js 8.11.4 security update","status":"published","published":"2024-09-13T16:52:29Z","modified":"2026-10-16T10:01:10Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2553","title":"Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Node.js 10.9.0 security update","status":"published","published":"2024-09-13T19:49:28Z","modified":"2026-10-16T10:01:10Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2944","title":"Red Hat Security Advisory: rh-nodejs6-nodejs security update","status":"published","published":"2024-09-13T16:53:40Z","modified":"2026-10-16T10:01:11Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2949","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","status":"published","published":"2024-09-13T19:49:56Z","modified":"2026-10-16T10:01:11Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:3537","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-29T17:23:15Z","modified":"2026-10-16T10:01:13Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.","status":"published","published":"2018-08-21T12:29:00Z","modified":"2026-04-22T11:43:03.512946Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"MGASA-2019-0277","title":"Updated nodejs packages fix security vulnerabilities","description":"This update provides nodejs v6.17.1 fixing at least the following security\nissues:\n\nThe c-ares function ares_parse_naptr_reply(), which is used for parsing\nNAPTR responses, could be triggered to read memory outside of the given\ninput buffer (CVE-2017-1000381) \n\nFix for 'path' module regular expression denial of service (CVE-2018-7158)\n\nReject spaces in HTTP Content-Length header values (CVE-2018-7159)\n\nFix for inspector DNS rebinding vulnerability (CVE-2018-7160)\n\nbuffer: Fixes Denial of Service vulnerability where calling Buffer.fill()\ncould hang (CVE-2018-7167)\n\nbuffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding\n(CVE-2018-12115)\n\nNode.js: HTTP request splitting (CVE-2018-12116)\n\nNode.js: Debugger port 5858 listens on any interface by default\n(CVE-2018-12120)\n\nNode.js: Denial of Service with large HTTP headers (CVE-2018-12121)\n\nNode.js: Slowloris HTTP Denial of Service (CVE-2018-12122)\n\nNode.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)\n\nNode.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)\n\nNode.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)\n\nFor other fixes in this update, see the referenced release logs.\n","status":"published","published":"2019-09-15T13:24:16Z","modified":"2026-04-16T04:41:44.565194424Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2018:2647-1","title":"Security update for nodejs4","description":"This update for nodejs4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be\n  used to write to memory outside of a Buffer's memory space buffer (bsc#1105019)\n- Upgrade to OpenSSL 1.0.2p, which fixed:\n  - CVE-2018-0732: Client denial-of-service due to large DH parameter (bsc#1097158)\n  - ECDSA key extraction via local side-channel\n\nOther changes made:\n\n- Recommend same major version npm package (bsc#1097748)\n- Use absolute paths in executable shebang lines\n- Fix building with ICU61.1 (bsc#1091764)\n- Install license with %license, not %doc (bsc#1082318)\n","status":"published","published":"2018-09-07T09:54:01Z","modified":"2026-02-04T04:22:09.760134Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2796-1","title":"Security update for nodejs6","description":"This update for nodejs6 to version 6.14.4 fixes the following issues:\n\nSecurity issues fixed:\n\nCVE-2018-12115: Fixed an out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (bsc#1105019)\nCVE-2018-0732: Upgrade to OpenSSL 1.0.2p, fixing a client DoS due to large DH parameter (bsc#1097158)\n\nOther issues fixed:\n\n- Recommend same major version npm package (bsc#1097748)\n","status":"published","published":"2018-09-21T15:08:56Z","modified":"2026-02-04T04:09:53.937211Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2812-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.11.4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be\n  used to write to memory outside of a Buffer's memory space buffer (bsc#1105019)\n- Upgrade to OpenSSL 1.0.2p, which fixed:\n  - CVE-2018-0732: Client denial-of-service due to large DH parameter (bsc#1097158)\n  - ECDSA key extraction via local side-channel\n\nOther changes made:\n\n- Recommend same major version npm package (bsc#1097748)\n- Fix parallel/test-tls-passphrase.js test to continue to function with older\n  versions of OpenSSL library.\n","status":"published","published":"2018-09-24T06:08:37Z","modified":"2026-02-04T03:12:17.67827Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","description":"\nThis update contains the Mozilla Firefox ESR 68.2 release.\n\nMozilla Firefox was updated to ESR 68.2 release:\n\n* Enterprise: New administrative policies were added. More\n  information and templates are available at the Policy\n  Templates page.\n\n* Various security fixes:\n  MFSA 2019-33 (bsc#1154738)\n  * CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber\n  * CVE-2019-11757: Use-after-free when creating index updates in IndexedDB\n  * CVE-2019-11758: Potentially exploitable crash due to 360 Total Security\n  * CVE-2019-11759: Stack buffer overflow in HKDF output\n  * CVE-2019-11760: Stack buffer overflow in WebRTC networking\n  * CVE-2019-11761: Unintended access to a privileged JSONView object\n  * CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation\n  * CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique\n  * CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2\n\nOther Issues resolved:\n\n* [bsc#1104841] Newer versions of firefox have a dependency on\n                GLIBCXX_3.4.20\n* [bsc#1074235] MozillaFirefox: background tab crash reports sent\n                inadvertently without user opt-in\n* [bsc#1043008] Firefox hangs randomly when browsing and\n                scrolling\n* [bsc#1025108] Firefox stops loading page until mouse is moved\n* [bsc#905528]  Firefox malfunctions due to broken omni.ja\n                archives\n\n","status":"published","published":"2020-01-17T17:07:38Z","modified":"2026-02-04T02:31:26.178072Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4796-1","title":"nodejs vulnerabilities","description":"Alexander Minozhenko and James Bunton discovered that Node.js did not\nproperly handle wildcards in name fields of X.509 TLS certificates. An\nattacker could use this vulnerability to execute a machine-in-the-middle-\nattack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)\n\nIt was discovered that Node.js incorrectly handled certain NAPTR responses.\nA remote attacker could possibly use this issue to cause applications using\nNode.js to crash, resulting in a denial of service. This issue only affected\nUbuntu 16.04 ESM. (CVE-2017-1000381)\n\nNikita Skovoroda discovered that Node.js mishandled certain input, leading\nto an out of bounds write. An attacker could use this vulnerability to\ncause a denial of service (crash) or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)\n\nArkadiy Tetelman discovered that Node.js improperly handled certain\nmalformed HTTP requests. An attacker could use this vulnerability to inject\nunexpected HTTP requests. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12116)\n\nJan Maybach discovered that Node.js did not time out if incomplete\nHTTP/HTTPS headers were received. An attacker could use this vulnerability\nto cause a denial of service by keeping HTTP/HTTPS connections alive for a\nlong period of time. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12122)\n\nMartin Bajanik discovered that the url.parse() method would return\nincorrect results if it received specially crafted input. An attacker could\nuse this vulnerability to spoof the hostname and bypass hostname-specific\nsecurity controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)\n\nIt was discovered that Node.js is vulnerable to a DNS rebinding attack which\ncould be exploited to perform remote code execution. An attack is possible\nfrom malicious websites open in a web browser with network access to the system\nrunning the Node.js process. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7160)\n\nIt was discovered that the Buffer.fill() and Buffer.alloc() methods\nimproperly handled certain inputs. An attacker could use this vulnerability\nto cause a denial of service. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7167)\n\nMarco Pracucci discovered that Node.js mishandled HTTP and HTTPS\nconnections. An attacker could use this vulnerability to cause a denial of\nservice. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)\n","status":"published","published":"2021-03-15T21:18:37Z","modified":"2026-06-29T13:48:17.400849278Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}