DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2020-06-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen oder seine Privilegien zu erweitern.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-8174US | high8.1 | — | ||
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. | ||||
| CVE-2020-8172US | high7.4 | — | ||
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. | ||||
| CVE-2020-11080US | high7.5 | — | ||
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SE… | ||||
| CVE-2020-10531US | high8.8 | — | ||
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeStr… | ||||
02
references
External citations — patches, advisories, analysis.
- SUSE Security Update SUSE-SU-2020:0819-2 vom 2020-07-08external
- SUSE Security Update SUSE-SU-2020:1568-1 vom 2020-06-09external
- SUSE Security Update SUSE-SU-2020:1576-1 vom 2020-06-09external
- SUSE Security Update SUSE-SU-2020:1575-1 vom 2020-06-09external
- SUSE Security Update SUSE-SU-2020:1623-1 vom 2020-06-16external
- SUSE Security Update SUSE-SU-2020:2800-1 vom 2020-09-30external
- Red Hat Security Advisory RHSA-2020:2523 vom 2020-06-11external
- Red Hat Security Advisory RHSA-2020:2524 vom 2020-06-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan