CVE-2016-5325
Fixed in a distro release EPSS 4%
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Products: nodejs node.js, suse linux_enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nodejs | 4.6.0~dfsg-1 |
| Debian 13 | nodejs | 4.6.0~dfsg-1 |
| Debian 14 | nodejs | 4.6.0~dfsg-1 |
| Red Hat openshift 3.1 | nodejs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.1 | nodejs-debuginfo | 0:0.10.47-2.el7 |
| Red Hat openshift 3.1 | nodejs-devel | 0:0.10.47-2.el7 |
| Red Hat openshift 3.1 | nodejs-docs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.1 | nodejs-tough-cookie | 0:2.3.1-1.el7 |
| Red Hat openshift 3.2 | nodejs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.2 | nodejs-debuginfo | 0:0.10.47-2.el7 |
| Red Hat openshift 3.2 | nodejs-devel | 0:0.10.47-2.el7 |
| Red Hat openshift 3.2 | nodejs-docs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.2 | nodejs-tough-cookie | 0:2.3.1-1.el7 |
| Red Hat openshift 3.3 | nodejs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.3 | nodejs-debuginfo | 0:0.10.47-2.el7 |
| Red Hat openshift 3.3 | nodejs-devel | 0:0.10.47-2.el7 |
| Red Hat openshift 3.3 | nodejs-docs | 0:0.10.47-2.el7 |
| Red Hat openshift 3.3 | nodejs-tough-cookie | 0:2.3.1-1.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-debuginfo | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-debuginfo | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-devel | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-devel | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-debuginfo | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-debuginfo | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-devel | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-devel | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-docs | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-docs | 0:4.6.2-4.el7 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs4 | 4.6.0-8.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| Ubuntu 14.04 LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2 |
| Ubuntu 16.04 LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2 |