CVE-2016-7099
Fixed in a distro release EPSS 3%
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Products: nodejs node.js, suse linux_enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nodejs | 4.6.0~dfsg-1 |
| Debian 13 | nodejs | 4.6.0~dfsg-1 |
| Debian 14 | nodejs | 4.6.0~dfsg-1 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-debuginfo | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-debuginfo | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-devel | 0:2.7.0-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-http-parser-devel | 0:2.7.0-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-debuginfo | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-debuginfo | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-devel | 0:4.6.2-4.el6 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-devel | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-docs | 0:4.6.2-4.el7 |
| Red Hat rhel software collections 2 | rh-nodejs4-nodejs-docs | 0:4.6.2-4.el6 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs4 | 4.6.0-8.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| Ubuntu Pro 14.04 LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2+esm1 |
| Ubuntu Pro 16.04 LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm1 |
| Ubuntu Pro 18.04 LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm1 |