[USN-6564-1] Node.js vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEELRdhz3KY7FGicMD8Vjg+NdFTuLIFAmWVR1oFAwAAAAAACgkQVjg+NdFTuLLV
OQv8DZ3jrg2gABV3VPFOvzClcTQbG1RSqxyj9+ItSqWNprNdBnp30UU6HWZTIqax8EO9KUWAIJ6d
RJHsmBv8LfgSqT21xj0CGCwS4YZdJB9jrhNik7HJuOpAz0VjIRgD+wC+rn/yef0yUQUJo+VYfGlB
VdtFjYhlMWZ22Ap+sNGuHzA2sbWyUtsmDx15Zw+QRXF8MtpFESyMTUGefAPS4k3FsT6Elx+nnABu
bCH5L8Rd5E8HldckLlGBoZFnR/fPC1RlT3NZZYg5xN4SYfDGbqe3/9p8vshhMJGmukYQmR0n2DEj
KR+/j3HuynY0nFLFer43uh960GQELK03bmW2NXA16vuspWrp4Mm3JJKt2He8iyweCqBilMOn3Sdj
E/YvVKR4Mwn8Z2PTddC6Fz+x8tB2XOWXrunVi3iiWAWZL8UkI6546p59et2dRFWg4/eagwXoWB5V
FH5bAiqObioAMWCzXdRJroWpWEvpwYsgjG12SJpuV0zCY7zdwHAOH3qJdHkh
=0Aqp
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6564-1
January 03, 2024

nodejs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Node.js.

Software Description:
- nodejs: An open-source, cross-platform JavaScript runtime environment.

Details:

Hubert Kario discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2022-4304)

CarpetFuzz, Dawei Wang discovered that Node.js incorrectly handled certain
inputs. If a user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-4450)

Octavio Galland and Marcel Böhme discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0215)

David Benjamin discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2023-0286)

Hubert Kario and Dmitry Belyavsky discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0401)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
libnode-dev 12.22.9~dfsg-1ubuntu3.3
libnode72 12.22.9~dfsg-1ubuntu3.3
nodejs 12.22.9~dfsg-1ubuntu3.3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6564-1
CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286,
CVE-2023-0401

Package Information:
https://launchpad.net/ubuntu/+source/nodejs/12.22.9~dfsg-1ubuntu3.3