皇上,还记得我吗?我就是1999年那个Linux伊甸园啊-----24小时滚动更新开源资讯,全年无休!

Node.js 10.9.0 、8.11.4 LTS 和 6.14.4 LTS 发布

Node.js 一口气发布了 10.9.0 、8.11.4 LTS 和 6.14.4  LTS 三个版本,均为安全修复版本,主要包含以下 CVE 的修复程序:

  • CVE-2018-0732(OpenSSL)
  • CVE-2018-7166(Node.js)
  • CVE-2018-12115(Node.js)

Node.js 10.9.0 值得注意的变化:

  • buffer:
    • Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
    • Fix unintentional exposure of uninitialized memory in Buffer.alloc() (CVE-2018-7166)
  • deps:
    • Memory reduction and performance improvements, details at: https://v8project.blogspot.com/2018/06/v8-release-68.html
    • Client DoS due to large DH parameter (CVE-2018-0732)
    • ECDSA key extraction via local side-channel (CVE not assigned)
    • Upgrade to OpenSSL 1.1.0i, fixing:
    • Upgrade V8 from 6.7 to 6.8 (Michaël Zasso) #21079
  • httphttp.get() and http.request() (and https variants) can now accept three arguments to allow for a URL and an options object (Sam Ruby) #21616

Node.js 8.11.4 LTS 和 6.14.4  LTS 值得注意的变化:

  • buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
  • deps: Upgrade to OpenSSL 1.0.2p, fixing:
    • Client DoS due to large DH parameter (CVE-2018-0732)
    • ECDSA key extraction via local side-channel (CVE not assigned)

更多细节和下载地址可查阅发行列表:

转自 https://www.oschina.net/news/99034/nodejs-10-9-0-released