{"id":"MGASA-2015-0454","aliases":[],"status":"published","title":"Updated uglify-js packages fix security vulnerability","description":"The UglifyJS node module has a problem where the combination of\nDe Morgan's Law and non-boolean values can lead to a case where code is\nincorrectly minified, which can lead to possibly malicious minified JS\ncode.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-11-19T22:08:19Z","modified":"2026-04-16T04:27:57Z","fixes":[{"ecosystem":"Mageia:5","package":"uglify-js","fixed_in":["2.4.24-3.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-align-text","fixed_in":["0.1.3-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-ansi-regex","fixed_in":["2.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-camelcase","fixed_in":["1.2.1-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-center-align","fixed_in":["0.1.1-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-cliui","fixed_in":["3.0.3-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-code-point-at","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-decamelize","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-invert-kv","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-is-buffer","fixed_in":["1.1.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-is-fullwidth-code-point","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-kind-of","fixed_in":["2.0.1-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-lcid","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-longest","fixed_in":["1.0.1-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-minimist","fixed_in":["1.2.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-number-is-nan","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-os-locale","fixed_in":["1.4.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-repeat-string","fixed_in":["1.5.2-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-right-align","fixed_in":["0.1.3-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-source-map","fixed_in":["0.5.1-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-string-width","fixed_in":["1.0.1-6.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-strip-ansi","fixed_in":["3.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-window-size","fixed_in":["0.1.2-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-wrap-ansi","fixed_in":["1.0.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-y18n","fixed_in":["3.2.0-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nodejs-yargs","fixed_in":["3.28.0-2.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"uglify-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.24-3.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-align-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-ansi-regex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-camelcase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-center-align","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-cliui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-code-point-at","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-decamelize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-invert-kv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-is-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-is-fullwidth-code-point","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-lcid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-longest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-minimist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-number-is-nan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-os-locale","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-repeat-string","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-right-align","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-source-map","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-string-width","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-6.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-strip-ansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-window-size","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-wrap-ansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs-yargs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-2.mga5"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2015-0454.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16643","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/08/24/5","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2015-0454","title":"Updated uglify-js packages fix security vulnerability","description":"The UglifyJS node module has a problem where the combination of\nDe Morgan's Law and non-boolean values can lead to a case where code is\nincorrectly minified, which can lead to possibly malicious minified JS\ncode.\n","status":"published","published":"2015-11-19T22:08:19Z","modified":"2026-04-16T04:27:57.065877Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}