CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000005

CVE-2018-1000005 affects libcurl 7.49.0 through 7.57.0, due to an out-of-bounds read when handling HTTP/2 trailers. Reading a trailer could corrupt future trailers, leading to a crash or potential information disclosure; the issue arises from mis-updated math after changing the header creation to...

CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000005: Out-of-bounds Read

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

PT-2018-9197

Name of the Vulnerable Software and Affected Versions: libcurl versions 7.49.0 through 7.57.0 Description: The issue is related to an out-of-bounds read in the code handling HTTP/2 trailers. This occurs because the stored size of the trailer data is one byte less than required, causing the data t...

Security fix for the ALT Linux 8 package curl version 7.58.0-alt1

Jan. 24, 2018 Anton Farygin 7.58.0-alt1 - new version - fixes: CVE-2018-1000005 HTTP/2 trailer out-of-bounds read CVE-2018-1000007 HTTP authentication leak in redirects...

Apache Httpd < 2.4.33 : Possible write of after free on HTTP/2 stream shutdown

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabilty hard to trigger in usual configurations, the reporter...

Merlin - A cross-platform post-exploitation HTTP/2 Command & Control server and agent

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang. An introductory blog post can be found here: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a Getting Started The quickest and easiest way to start using Merlin is download the...

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

Design/Logic Flaw

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

UBUNTU-CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

CVE-2017-10908

CVE-2017-10908 affects the H2O HTTP Server (versions

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

CVE-2017-10908

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header...

PT-2017-11600

Name of the Vulnerable Software and Affected Versions H2O versions 2.2.3 and earlier Description The issue allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header. Recommendations For versions 2.2.3 and earlier, update to a version later than 2.2.3 t...