New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release proposal: v4.6.1 #9153

Closed

rvagg wants to merge 3 commits into nodejs:v4.x from rvagg:v4.6.1-proposal

Commits on Oct 18, 2016

deps: avoid single-byte buffer overwrite

Incorrect string length calculation when passing escaped dot.

- CVE: CVE-2016-5180
- Upstream bug: https://c-ares.haxx.se/adv_20160929.html

Ref: nodejs#9037
PR-URL: nodejs#8849
Reviewed-By: Myles Borins <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Johan Bergström <[email protected]>
Reviewed-By: Fedor Indutny <[email protected]>

bagder authored and rvagg committed Oct 18, 2016

win,build: try multiple timeservers when signing
```
PR-URL: nodejs#9155
Reviewed-By: Johan Bergström <[email protected]>
Reviewed-By: João Reis <[email protected]>
```
rvagg committed Oct 18, 2016
Configuration menu
View commit details

Copy full SHA for 5a0daa6

Browse repository at this point
Copy the full SHA

5a0daa6 View commit details

Browse the repository at this point in the history

2016-10-18, Version 4.6.1 'Argon' (LTS)

This is a security release. All Node.js users should consult the security
release summary at
https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/
for details on patched vulnerabilities.

Notable changes:

* c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more
  information at https://c-ares.haxx.se/adv_20160929.html (Daniel Stenberg)

PR-URL: nodejs#9153

rvagg committed Oct 18, 2016