FS#64906 : [npm] [Security] arbitrary file overwrite (CVE-2019-16777 CVE-2019-16776 CVE-2019-16775)

FS#64906 - [npm] [Security] arbitrary file overwrite (CVE-2019-16777 CVE-2019-16776 CVE-2019-16775)

Attached to Project: Community Packages
Opened by Morten Linderud (Foxboron) - Friday, 20 December 2019, 10:13 GMT
Last edited by Felix Yan (felixonmars) - Thursday, 26 December 2019, 19:16 GMT

Task Type	Bug Report
Category	Packages
Status	Closed
Assigned To	Felix Yan (felixonmars)
Architecture	All
Severity	Medium
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

Summary
=======

The package npm is vulnerable to arbitrary file overwrite via CVE-2019-16777, CVE-2019-16776 and CVE-2019-16775.

Guidance
========

Please update to the latest release

References
==========

https://security.archlinux.org/AVG-1082
https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr
https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46
https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx

This task depends upon

Closed by Felix Yan (felixonmars)
Thursday, 26 December 2019, 19:16 GMT
Reason for closing: Fixed
Additional comments about closing: 6.13.4-1

Comment by loqs (loqs) - Friday, 20 December 2019, 12:04 GMT

Is this the same as ~~FS#64821~~ ?

Comment by Morten Linderud (Foxboron) - Friday, 20 December 2019, 12:21 GMT

It is and I didn't see it, but the text is not from the tracker so it's a bit less useful IMO. I'll move the content there and replace the security tracker bug link

	Tasks related to this task (0)

Duplicate tasks of this task (0)

Arch Linux

FS#64906 - [npm] [Security] arbitrary file overwrite (CVE-2019-16777 CVE-2019-16776 CVE-2019-16775)

Details

Loading...