CVE-2015-8659
The idle stream handling in nghttp2 before 1.6.0 allows attackers to h ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS.
Açıklama
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 4.0 | cmake | 3.18.3-7.ph4 |
| debian 11 | nghttp2 | 1.6.0-1 |
| debian 12 | nghttp2 | 1.6.0-1 |
| debian 13 | nghttp2 | 1.6.0-1 |
| debian 14 | nghttp2 | 1.6.0-1 |
| echo | nghttp2 | 1.6.0-1 |
| root.io debian 12 | rootio-nghttp2 | 1.6.0-1 |
| root.io debian 13 | rootio-nghttp2 | 1.6.0-1 |
Referanslar
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html
- http://www.openwall.com/lists/oss-security/2015/12/23/10
- http://www.openwall.com/lists/oss-security/2015/12/23/6