{"id":"CVE-2019-13173","aliases":["CLSA-2026-1773188137","DEBIAN-CVE-2019-13173","EUVD-2019-0484","GHSA-xf7w-r453-m56c","OESA-2022-1584","OESA-2022-2084","SUSE-SU-2019:14246-1","SUSE-SU-2019:2055-1","SUSE-SU-2019:2078-1","SUSE-SU-2019:2081-1","SUSE-SU-2019:2099-1","SUSE-SU-2019:2181-1","SUSE-SU-2020:0059-1","UBUNTU-CVE-2019-13173","USN-4123-1","USN-4863-1","openSUSE-SU-2019:1846-1","openSUSE-SU-2019:1907-1"],"status":"published","title":"Arbitrary File Overwrite in fstream","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02416,"percentile":0.84263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-05-30T17:19:34Z","modified":"2026-10-20T10:50:42Z","fixes":[{"ecosystem":"npm","package":"fstream","fixed_in":["1.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fstream","fixed_in":["1.0.8-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-fstream","fixed_in":["1.0.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-fstream","fixed_in":["1.0.12-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-fstream","fixed_in":["1.0.12-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-fstream","fixed_in":["1.0.12-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-fstream","fixed_in":["1.0.12-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-fstream","fixed_in":["1.0.12-1.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","fixed_in":["8.15.1-3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","fixed_in":["8.15.1-3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","fixed_in":["4.9.1-15.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs4","fixed_in":["4.9.1-15.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","fixed_in":["10.16.0-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","fixed_in":["10.16.0-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","fixed_in":["10.16.0-1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","fixed_in":["6.17.0-11.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","fixed_in":["6.17.0-11.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nodejs6","fixed_in":["6.17.0-11.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","fixed_in":["6.17.0-11.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs6","fixed_in":["6.17.0-11.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-fstream","fixed_in":["0.1.24-1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-fstream","fixed_in":["0.1.24-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-fstream","fixed_in":["1.0.10-1ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"nodejs10","fixed_in":["10.16.0-lp151.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"nodejs8","fixed_in":["8.15.1-lp151.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","fixed_in":["8.15.1-lp151.2.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-tuxcare.0"},{"fixed":"1.0.8-tuxcare.3"}]}],"versions":["1.0.8","1.0.8-tuxcare.1","1.0.8-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1"}]}]},{"source":"osv","ecosystem":"npm","package":"fstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.12"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.12-1.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.2.0-78.51.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68-21.9.8"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-atk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2.13.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.11-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-2.14.7"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.9-2.15.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-harfbuzz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.git259-2.3.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-14.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-pango","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.14-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21-29.6.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45-38.9.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.1-3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.1-3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.0-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.0-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.0-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.13.0-1.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.24-1ubuntu0.14.04.1~esm1"}]}],"versions":["0.1.22-1","0.1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.24-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-1ubuntu0.18.04.1"}]}],"versions":["1.0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-1ubuntu0.18.04.1"}]}],"versions":["1.0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.24-1ubuntu0.14.04.1~esm1"}]}],"versions":["0.1.22-1","0.1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-fstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.24-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.1.24-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.0-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.1-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.1-lp151.2.3.1"}]}]}],"products":[{"vendor":"fstream_project","product":"fstream"}],"references":[{"url":"https://www.npmjs.com/advisories/886","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4123-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13173","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xf7w-r453-m56c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13173","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4123-1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1584","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2084","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000036","tags":["report"]},{"url":"https://bugzilla.suse.com/1001652","tags":["report"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/104105","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1043008","tags":["report"]},{"url":"https://bugzilla.suse.com/1044946","tags":["report"]},{"url":"https://bugzilla.suse.com/1047925","tags":["report"]},{"url":"https://bugzilla.suse.com/1047936","tags":["report"]},{"url":"https://bugzilla.suse.com/1048299","tags":["report"]},{"url":"https://bugzilla.suse.com/1049186","tags":["report"]},{"url":"https://bugzilla.suse.com/1050653","tags":["report"]},{"url":"https://bugzilla.suse.com/1056058","tags":["report"]},{"url":"https://bugzilla.suse.com/1058013","tags":["report"]},{"url":"https://bugzilla.suse.com/1066242","tags":["report"]},{"url":"https://bugzilla.suse.com/1066953","tags":["report"]},{"url":"https://bugzilla.suse.com/1070738","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1072320","tags":["report"]},{"url":"https://bugzilla.suse.com/1072322","tags":["report"]},{"url":"https://bugzilla.suse.com/1073796","tags":["report"]},{"url":"https://bugzilla.suse.com/1073798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073799","tags":["report"]},{"url":"https://bugzilla.suse.com/1073803","tags":["report"]},{"url":"https://bugzilla.suse.com/1073808","tags":["report"]},{"url":"https://bugzilla.suse.com/1073818","tags":["report"]},{"url":"https://bugzilla.suse.com/1073823","tags":["report"]},{"url":"https://bugzilla.suse.com/1073829","tags":["report"]},{"url":"https://bugzilla.suse.com/1073830","tags":["report"]},{"url":"https://bugzilla.suse.com/1073832","tags":["report"]},{"url":"https://bugzilla.suse.com/1073846","tags":["report"]},{"url":"https://bugzilla.suse.com/1074235","tags":["report"]},{"url":"https://bugzilla.suse.com/1077230","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1087453","tags":["report"]},{"url":"https://bugzilla.suse.com/1087459","tags":["report"]},{"url":"https://bugzilla.suse.com/1087463","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1091764","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1097158","tags":["report"]},{"url":"https://bugzilla.suse.com/1097375","tags":["report"]},{"url":"https://bugzilla.suse.com/1097401","tags":["report"]},{"url":"https://bugzilla.suse.com/1097404","tags":["report"]},{"url":"https://bugzilla.suse.com/1097748","tags":["report"]},{"url":"https://bugzilla.suse.com/1104841","tags":["report"]},{"url":"https://bugzilla.suse.com/1105019","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1109465","tags":["report"]},{"url":"https://bugzilla.suse.com/1117473","tags":["report"]},{"url":"https://bugzilla.suse.com/1117626","tags":["report"]},{"url":"https://bugzilla.suse.com/1117627","tags":["report"]},{"url":"https://bugzilla.suse.com/1117629","tags":["report"]},{"url":"https://bugzilla.suse.com/1117630","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1123482","tags":["report"]},{"url":"https://bugzilla.suse.com/1124525","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130694","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1133810","tags":["report"]},{"url":"https://bugzilla.suse.com/1134209","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://bugzilla.suse.com/1140290","tags":["report"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1144919","tags":["report"]},{"url":"https://bugzilla.suse.com/1145665","tags":["report"]},{"url":"https://bugzilla.suse.com/1146090","tags":["report"]},{"url":"https://bugzilla.suse.com/1146091","tags":["report"]},{"url":"https://bugzilla.suse.com/1146093","tags":["report"]},{"url":"https://bugzilla.suse.com/1146094","tags":["report"]},{"url":"https://bugzilla.suse.com/1146095","tags":["report"]},{"url":"https://bugzilla.suse.com/1146097","tags":["report"]},{"url":"https://bugzilla.suse.com/1146099","tags":["report"]},{"url":"https://bugzilla.suse.com/1146100","tags":["report"]},{"url":"https://bugzilla.suse.com/1149323","tags":["report"]},{"url":"https://bugzilla.suse.com/1153423","tags":["report"]},{"url":"https://bugzilla.suse.com/1154738","tags":["report"]},{"url":"https://bugzilla.suse.com/1447070","tags":["report"]},{"url":"https://bugzilla.suse.com/1447409","tags":["report"]},{"url":"https://bugzilla.suse.com/744625","tags":["report"]},{"url":"https://bugzilla.suse.com/744629","tags":["report"]},{"url":"https://bugzilla.suse.com/845955","tags":["report"]},{"url":"https://bugzilla.suse.com/865853","tags":["report"]},{"url":"https://bugzilla.suse.com/905528","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/937414","tags":["report"]},{"url":"https://bugzilla.suse.com/947747","tags":["report"]},{"url":"https://bugzilla.suse.com/948045","tags":["report"]},{"url":"https://bugzilla.suse.com/948602","tags":["report"]},{"url":"https://bugzilla.suse.com/955142","tags":["report"]},{"url":"https://bugzilla.suse.com/957814","tags":["report"]},{"url":"https://bugzilla.suse.com/957815","tags":["report"]},{"url":"https://bugzilla.suse.com/961254","tags":["report"]},{"url":"https://bugzilla.suse.com/962297","tags":["report"]},{"url":"https://bugzilla.suse.com/966076","tags":["report"]},{"url":"https://bugzilla.suse.com/966077","tags":["report"]},{"url":"https://bugzilla.suse.com/985201","tags":["report"]},{"url":"https://bugzilla.suse.com/986541","tags":["report"]},{"url":"https://bugzilla.suse.com/991344","tags":["report"]},{"url":"https://bugzilla.suse.com/998743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192055-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192078-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1134208","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192099-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192181-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149792","tags":["report"]},{"url":"https://bugzilla.suse.com/SLE-8947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13173","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4123-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13173","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4863-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NDOPRHO5EBJWVNZ5TQMMR6AYEXTLSZ4C/#NDOPRHO5EBJWVNZ5TQMMR6AYEXTLSZ4C","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OEF44VNT7HJJD4TMRP7ODKCAZZAPHOPU/#OEF44VNT7HJJD4TMRP7ODKCAZZAPHOPU","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-13173","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T19:26:05Z","modified":"2024-08-04T23:41:10.702Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-0484","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T19:26:05Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:44.337354Z"}],"ghsa":[{"id":"GHSA-xf7w-r453-m56c","title":"Arbitrary File Overwrite in fstream","description":"Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable.\n\n\n## Recommendation\n\nUpgrade to version 1.0.12 or later.","status":"published","published":"2019-05-30T17:19:34Z","modified":"2025-02-12T05:08:43Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2019-13173","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T20:15:11.823Z","modified":"2026-06-17T02:16:13.18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-13173","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T20:15:11.823Z","modified":"2026-10-20T10:50:42.056614766Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13173","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T20:15:11.823Z","modified":"2026-09-21T07:00:58.528761564Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-xf7w-r453-m56c","title":"Arbitrary File Overwrite in fstream","description":"Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable.\n\n\n## Recommendation\n\nUpgrade to version 1.0.12 or later.","status":"published","published":"2019-05-30T17:19:34Z","modified":"2023-11-08T04:01:07.720925Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"OESA-2022-1584","title":"nodejs-fstream security update","description":"Provides advanced file system stream objects for Node.js.  These objects are like FS streams, but with stat on them, and support directories and symbolic links, as well as normal files.  Also, you can use them to set the stats on a file, even if you don\u0026apos;t change its contents, or to create a symlink, etc.\r\n\r\nSecurity Fix(es):\r\n\r\nfstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system\u0026apos;s file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.(CVE-2019-13173)","status":"published","published":"2022-03-19T11:04:51Z","modified":"2026-08-18T01:15:53.195499691Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2084","title":"nodejs-fstream security update","description":"Provides advanced file system stream objects for Node.js.  These objects are like FS streams, but with stat on them, and support directories and symbolic links, as well as normal files.  Also, you can use them to set the stats on a file, even if you don\u0026apos;t change its contents, or to create a symlink, etc.\r\n\r\nSecurity Fix(es):\r\n\r\nfstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system\u0026apos;s file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.(CVE-2019-13173)","status":"published","published":"2022-11-11T11:05:24Z","modified":"2026-08-18T01:17:26.893367392Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2019-13173","description":"fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.","status":"published","published":"2019-07-02T00:00:00Z","modified":"2026-02-04T03:11:46.240147Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"CLSA-2026-1773188137","title":"TuxCare security update for fstream (1 CVE)","description":"TuxCare rebuilt fstream to address 1 CVE. Fixed in 1.0.8-tuxcare.3.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.161091661Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"openSUSE-SU-2019:1846-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.0 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n\nNon-security issue fixed:\n\n- Update to new upstream LTS version 10.16.0, including npm version 6.9.0 and openssl version 1.1.1b (bsc#1134208).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-12T16:13:44Z","modified":"2026-02-04T04:36:04.314724Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1907-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n\nNon-security issue fixed:\n\n- Backported fixes for OpenSSL 1.1.1 from nodejs8 (bsc#1134209).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-15T09:43:16Z","modified":"2026-02-04T03:30:17.538091Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","description":"\nThis update contains the Mozilla Firefox ESR 68.2 release.\n\nMozilla Firefox was updated to ESR 68.2 release:\n\n* Enterprise: New administrative policies were added. More\n  information and templates are available at the Policy\n  Templates page.\n\n* Various security fixes:\n  MFSA 2019-33 (bsc#1154738)\n  * CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber\n  * CVE-2019-11757: Use-after-free when creating index updates in IndexedDB\n  * CVE-2019-11758: Potentially exploitable crash due to 360 Total Security\n  * CVE-2019-11759: Stack buffer overflow in HKDF output\n  * CVE-2019-11760: Stack buffer overflow in WebRTC networking\n  * CVE-2019-11761: Unintended access to a privileged JSONView object\n  * CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation\n  * CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique\n  * CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2\n\nOther Issues resolved:\n\n* [bsc#1104841] Newer versions of firefox have a dependency on\n                GLIBCXX_3.4.20\n* [bsc#1074235] MozillaFirefox: background tab crash reports sent\n                inadvertently without user opt-in\n* [bsc#1043008] Firefox hangs randomly when browsing and\n                scrolling\n* [bsc#1025108] Firefox stops loading page until mouse is moved\n* [bsc#905528]  Firefox malfunctions due to broken omni.ja\n                archives\n\n","status":"published","published":"2020-01-17T17:07:38Z","modified":"2026-02-04T02:31:26.178072Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2055-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n\nNon-security issue fixed:\n\n- Backported fixes for OpenSSL 1.1.1 from nodejs8 (bsc#1134209).\n","status":"published","published":"2019-08-06T08:35:17Z","modified":"2026-02-04T03:03:10.195671Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2078-1","title":"Security update for nodejs4","description":"This update for nodejs4 fixes the following issues:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n","status":"published","published":"2019-08-07T09:38:50Z","modified":"2026-02-04T03:48:38.692275Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2081-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.0 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n\nNon-security issue fixed:\n\n- Update to new upstream LTS version 10.16.0, including npm version 6.9.0 and openssl version 1.1.1b (bsc#1134208).\n","status":"published","published":"2019-08-07T11:34:39Z","modified":"2026-02-04T04:25:13.634629Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2099-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.0 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n\nNon-security issue fixed:\n\n- Update to new upstream LTS version 10.16.0, including npm version 6.9.0 and openssl version 1.1.1b (bsc#1134208).\n","status":"published","published":"2019-08-09T07:31:55Z","modified":"2026-02-04T03:39:59.238207Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2181-1","title":"Security update for nodejs6","description":"This update for nodejs6 fixes the following issues:\n\n- CVE-2019-13173: Fixed a potential file overwrite via hardlink in fstream.DirWriter() (bsc#1140290).\n","status":"published","published":"2019-08-19T14:53:54Z","modified":"2026-02-04T03:08:54.198266Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:0059-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to LTS release 12.13.0 (jsc#SLE-8947).\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).\n- CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).\n- CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).\n- CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).\n- CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n- CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).\n","status":"published","published":"2020-01-09T12:30:16Z","modified":"2026-02-04T03:18:59.602282Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4123-1","title":"npm/fstream vulnerability","description":"It was discovered that npm/fstream incorrectly handled certain crafted\ntarballs. An attacker could use this vulnerability to write aritrary files to\nthe filesystem.\n","status":"published","published":"2019-09-05T12:42:06Z","modified":"2026-02-10T04:41:38Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4863-1","title":"node-fstream vulnerability","description":"It was discovered that fstream incorrectly handled certain crafted\ntarballs. An attacker could use this vulnerability to write arbitrary files\nto the filesystem.","status":"published","published":"2021-03-15T22:50:59Z","modified":"2026-06-29T13:48:00.205051812Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}