Bug 17305

Summary:	nodejs new security issue CVE-2015-8027
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Joseph Wang <joequant>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal
Version:	Cauldron
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/666960/
Whiteboard:
Source RPM:	nodejs-0.10.38-1.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2015-12-07 17:10:23 CET

Upstream has issued an advisory on December 4:
https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/

The issue is fixed upstream in 0.10.41:
https://nodejs.org/en/blog/release/v0.10.41/

Mageia 5 is also affected.

Reproducible: 

Steps to Reproduce:

David Walser 2015-12-07 17:10:30 CET

Whiteboard: (none) => MGA5TOO

Comment 1 David Walser 2016-01-12 18:48:03 CET

Joseph updated Cauldron to version 5.3.0.

I just noticed that CVE-2015-8027 doesn't affect 0.10.x.

I'll open a new bug for the 0.10.41 bugfix release.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Whiteboard: MGA5TOO => (none)