All ProjectsArch LinuxCommunity PackagesPacmanRelease Engineering Switch

Show Task #

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

Tasklist

FS#64906 - [npm] [Security] arbitrary file overwrite (CVE-2019-16777 CVE-2019-16776 CVE-2019-16775)

Task Type Bug Report Category Packages Status Closed Assigned To Felix Yan (felixonmars) Architecture All Severity Medium Priority Normal Reported Version Due in Version Undecided Due Date Undecided Percent Complete Votes 0 Private No

Details Summary ======= The package npm is vulnerable to arbitrary file overwrite via CVE-2019-16777, CVE-2019-16776 and CVE-2019-16775. Guidance ======== Please update to the latest release References ========== https://security.archlinux.org/AVG-1082 https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46 https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx