Security update for nodejs12
This update for nodejs12 fixes the following issues: Update to LTS release 12.13.0 (jsc#SLE-8947). Security issues fixed: - CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091). - CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099). - CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094). - CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100). - CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). - CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for nodejs12 fixes the following issues: Update to LTS release 12.13.0 (jsc#SLE-8947). Security issues fixed: - CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091). - CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099). - CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094). - CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095). - CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100). - CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090). - CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097). - CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). - CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1140290
- https://bugzilla.suse.com/1146090
- https://bugzilla.suse.com/1146091
- https://bugzilla.suse.com/1146093
- https://bugzilla.suse.com/1146094
- https://bugzilla.suse.com/1146095
- https://bugzilla.suse.com/1146097
- https://bugzilla.suse.com/1146099
- https://bugzilla.suse.com/1146100
- https://bugzilla.suse.com/1149792
- https://bugzilla.suse.com/SLE-8947
- https://www.suse.com/security/cve/CVE-2019-13173
- https://www.suse.com/security/cve/CVE-2019-9511
- https://www.suse.com/security/cve/CVE-2019-9512
- https://www.suse.com/security/cve/CVE-2019-9513
- https://www.suse.com/security/cve/CVE-2019-9514
- https://www.suse.com/security/cve/CVE-2019-9515
- https://www.suse.com/security/cve/CVE-2019-9516
- https://www.suse.com/security/cve/CVE-2019-9517
- https://www.suse.com/security/cve/CVE-2019-9518
- https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/