Input validation

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

CVE-2018-1000168 affects nghttp2 versions 1.10.0 through 1.31.0, where an improper input validation in ALTSVC frame handling can cause a segmentation fault and denial of service. The vulnerability is exploitable via network clients. Public advisories confirm the issue is fixed in nghttp2 >= 1....

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168: Improper Input Validation

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

Fedora 27 : nghttp2 (2018-cec96a9c41)

update to the latest upstream release fixes CVE-2018-1000168 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 27 Update: nghttp2-1.31.1-1.fc27

This package contains the HTTP/2 client, server and proxy programs...

Fedora Update for nghttp2 FEDORA-2018-cec96a9c41

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: nghttp2-1.31.1-1.fc28

This package contains the HTTP/2 client, server and proxy programs...

nghttp2 < 1.31.1 DoS Vulnerability

nghttpd2 is prone to a denial of service DoS vulnerability due to a NULL pointer deference. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

FreeBSD : nghttp2 -- Denial of service due to NULL pointer dereference (1fccb25e-8451-438c-a2b9-6a021e4d7a31)

nghttp2 blog : If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. ALTSVC frame is defined by RFC 783...

UBUNTU-CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

CVE-2018-1000168

nghttp2 version = 1.10.0 and nghttp2 = 1.31.1...

Node.js: Denial of Service: nghttp2 use of uninitialized pointer

While investigating https://hackerone.com/reports/335533 and while following the same reproduction steps, I uncovered a bug in nghttp2 that causes use of an uninitialized pointer for an altsvc frameresulting in crash. The error can be easily triggered by a remote attacker by sending malformed...

nghttp2 -- Denial of service due to NULL pointer dereference

nghttp2 blog: If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. ALTSVC frame is defined by RFC 7838...

Unnamed Vulnerability in Apple iOS/tvOS/macOS/watchOS HTTPProtocol Component

iOS is a mobile operating system developed by Apple Inc. First announced at the Macworld conference on January 9, 2007, it was originally designed for use with the iPhone, and has since been applied to the iPod touch, iPad, and Apple TV. tvOS is an Apple-developed system based on iOS. tvOS is the...

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...