diff options
| author | Martin Bark <martin@barkynet.com> | 2017-07-13 13:24:31 +0100 |
|---|---|---|
| committer | Peter Korsgaard <peter@korsgaard.com> | 2017-07-13 22:54:53 +0200 |
| commit | 476ccdb3e49be2349248385dbacf4a72efebe343 (patch) | |
| tree | 603924f498bb3e9cc5ab5bc76c84f3a610721aa4 /package/nodejs/nodejs.hash | |
| parent | f97510659f914ee51c0f32e82664179a69ab17ba (diff) | |
| download | buildroot-476ccdb3e49be2349248385dbacf4a72efebe343.tar.gz buildroot-476ccdb3e49be2349248385dbacf4a72efebe343.zip | |
package/nodejs: security bump to version 8.1.4
Fixes CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which
is used for parsing NAPTR responses, could be triggered to read memory
outside of the given input buffer if the passed in DNS response packet was
crafted in a particular way. This patch checks that there is enough data
for the required elements of an NAPTR record (2 int16, 3 bytes for string
lengths) before processing a record.
See https://nodejs.org/en/blog/release/v8.1.4/
[Peter: add CVE info]
Signed-off-by: Martin Bark <martin@barkynet.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Diffstat (limited to 'package/nodejs/nodejs.hash')
| -rw-r--r-- | package/nodejs/nodejs.hash | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/package/nodejs/nodejs.hash b/package/nodejs/nodejs.hash index 989616c33f..93aa6a1d02 100644 --- a/package/nodejs/nodejs.hash +++ b/package/nodejs/nodejs.hash @@ -1,2 +1,2 @@ -# From upstream URL: http://nodejs.org/dist/v8.1.2/SHASUMS256.txt -sha256 ac190c1964ee0c28d4c163c0ccbb47435b2e4bd9b4c065b74a93373105c574b3 node-v8.1.2.tar.xz +# From upstream URL: http://nodejs.org/dist/v8.1.4/SHASUMS256.txt +sha256 a83c86445f79749c46fd4f2c4e681a3e5bb51b2bde5dc7aed1dc38e4e242c301 node-v8.1.4.tar.xz |
