]> rtime.felk.cvut.cz Git - coffee/buildroot.git/commit
package/nodejs: security bump to version 8.1.4
authorMartin Bark <martin@barkynet.com>
Thu, 13 Jul 2017 12:24:31 +0000 (13:24 +0100)
committerPeter Korsgaard <peter@korsgaard.com>
Thu, 13 Jul 2017 20:54:53 +0000 (22:54 +0200)
commit476ccdb3e49be2349248385dbacf4a72efebe343
tree603924f498bb3e9cc5ab5bc76c84f3a610721aa4
parentf97510659f914ee51c0f32e82664179a69ab17ba
package/nodejs: security bump to version 8.1.4

Fixes CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which
is used for parsing NAPTR responses, could be triggered to read memory
outside of the given input buffer if the passed in DNS response packet was
crafted in a particular way.  This patch checks that there is enough data
for the required elements of an NAPTR record (2 int16, 3 bytes for string
lengths) before processing a record.

See https://nodejs.org/en/blog/release/v8.1.4/

[Peter: add CVE info]
Signed-off-by: Martin Bark <martin@barkynet.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/nodejs/nodejs.hash
package/nodejs/nodejs.mk