JVN#84182676: Multiple vulnerabilities in H2O

H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS...

FreeBSD : h2o -- DoS in workers (10c0fabc-b5da-11e7-816e-00bd5d1fff09)

Frederik Deweerdt reports : Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details. CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing. CVE-2017-10869: The stack may overflow when proxying huge requests. %NASLMINLEVE...

h2o -- DoS in workers

Frederik Deweerdt reports: Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details. CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing. CVE-2017-10869: The stack may overflow when proxying huge requests...

h2o: <no crash state available>

Project: https://github.com/h2o/h2o.git Detailed report: https://oss-fuzz.com/testcase?key=4581434322845696 Project: h2o Fuzzer: libFuzzerh2oh2o-fuzzer-http2 Fuzz target binary: h2o-fuzzer-http2 Job Type: libfuzzerasanh2o Platform Id: linux Crash Type: Null-dereference READ Crash Address:...

CVE-2016-7835

Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service DoS or obtain server certificate private keys and possibly other information...

Design/Logic Flaw

Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service DoS or obtain server certificate private keys and possibly other information...

CVE-2016-7835

The CVE-2016-7835 issue affects the H2O HTTP Server prior to version 2.0.5 and some 2.1.x builds (beta 4). Root cause is a use-after-free during the HTTP/1 to HTTP/2 upgrade, allowing remote attackers to cause a DoS and potentially access server certificate private keys or other information. Reme...

CVE-2016-7835

Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service DoS or obtain server certificate private keys and possibly other information...

CVE-2016-7835

Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service DoS or obtain server certificate private keys and possibly other information...

CVE-2016-4864

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...

Format string

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...

CVE-2016-4864

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...

CVE-2016-4864

CVE-2016-4864 affects H2O web server: versions 2.0.3 and earlier and 2.1.0-beta2 and earlier are vulnerable to a DoS via format string specifiers in template files processed by fastcgi, mruby, proxy, redirect or reproxy. Connected sources confirm this vulnerability class and affected ranges, with...

CVE-2016-4864

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...

CVE-2016-4864

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service DoS via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy...

FreeBSD : h2o -- Use-after-free vulnerability (d0b12952-cb86-11e6-906f-0cc47a065786)

Kazuho Oku reports : A use-after-free vulnerability exists in H2O up to and including version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to mount DoS attacks and / or information theft. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

H2O Denial of Service Vulnerability

H2O is a set of open source Web server software . A denial of service vulnerability exists in H2O. An attacker could exploit this vulnerability to cause a denial of service or obtain sensitive information...

H2O HTTP Server < 2.0.5, 2.1.x < 2.1.0-beta4 DoS Vulnerability

H2O HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:h2oproject:h2o"; i...

H2O use-after-free vulnerability

Overview H2O is an open source web server software. H2O contains a use-after-free vulnerability CWE-416 due to a flaw in the process of upgrading from HTTP/1 to HTTP/2. Kazuho Oku reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Kazuho Oku coordinated...

JVN#44566208: H2O use-after-free vulnerability

H2O is an open source web server software. H2O contains a use-after-free vulnerability CWE-416 due to a flaw in the process of upgrading from HTTP/1 to HTTP/2. Impact An unauthenticated remote attacker may cause a denial-of-service DoS condition or obtain arbitrary information which may include t...