SOL12254802 - Apache httpd HTTP/2 vulnerability CVE-2016-1546

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

Modern Reverse Proxy: Traefik

Modern Reverse Proxy Træfɪk is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease. It supports several backends Docker , Swarm , Mesos/Marathon , Kubernetes , Consul , Etcd , Zookeeper , BoltDB , Rest API, file… to manage its configuration automatically and...

h2o -- use after free on premature connection close

Tim Newsha reports: When H2O tries to disconnect a premature HTTP/2 connection, it calls free3 to release memory allocated for the connection and immediately after then touches the memory. No malloc-related operation is performed by the same thread between the time it calls free and the time the...

wireshark-gtk: denial of service

CVE-2016-2522: The dissectberconstrainedbitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service out-of-bounds read and application...

Mageia: Security Advisory (MGASA-2016-0091)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code : - 3GPP TS 32.423 Trace file...

Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities (Mac OS X)

The version of Wireshark installed on the remote Mac OS X host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code : - 3GPP TS 32.423 Trace fil...

FreeBSD : wireshark -- multiple vulnerabilities (45117749-df55-11e5-b2bd-002590263bf5)

Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-02 ASN.1 BER dissector crash. Bug 11828 CVE-2016-2522 - wnpa-sec-2016-03 DNP dissector infinite loop. Bug 11938 CVE-2016-2523 - wnpa-sec-2016-04 X.509AF dissector crash. Bug 12002 CVE-2016-2524 -...

CVE-2016-2525

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

CVE-2016-2525

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

Code injection

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

CVE-2016-2525

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

CVE-2016-2525

CVE-2016-2525 affects Wireshark 2.0.x before 2.0.2, where the HTTP/2 dissector (epan/dissectors/packet-http2.c) does not limit header data, enabling remote attackers to cause a denial of service via crafted packets (memory consumption or crash). Public advisories (including Debian and Mageia) con...

CVE-2016-2525

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

wireshark -- multiple vulnerabilities

Wireshark development team reports: The following vulnerabilities have been fixed: wnpa-sec-2016-02 ASN.1 BER dissector crash. Bug 11828 CVE-2016-2522 wnpa-sec-2016-03 DNP dissector infinite loop. Bug 11938 CVE-2016-2523 wnpa-sec-2016-04 X.509AF dissector crash. Bug 12002 CVE-2016-2524...

[SECURITY] Fedora 22 Update: nghttp2-1.7.1-1.fc22

This package contains the HTTP/2 client, server and proxy programs...

[SECURITY] Fedora 23 Update: nghttp2-1.7.1-1.fc23

This package contains the HTTP/2 client, server and proxy programs...

nghttp2: denial of service

HTTP/2 uses HPACK to compress header fields. The basic idea is that HTTP header field is stored in the receiver with the numeric index number. The memory used by this storage is tightly constrained, and it is 4KiB by default. When sender sends the same header field, it just sends the correspondin...

The future of loading CSS

Chrome is intending to change the behaviour of , which will be noticeable when it appears within . The impact and benefits of this aren't clear from the blink-dev post, so I wanted to go into detail here. Update: This is now in Chrome Canary. The current state of loading CSS …content… CSS blocks...

nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio

Nghttp2 reports: Out of memory in nghttpd, nghttp, and libnghttp2asio applications due to unlimited incoming HTTP header fields. nghttpd, nghttp, and libnghttp2asio applications do not limit the memory usage for the incoming HTTP header field. If peer sends specially crafted HTTP/2 HEADERS frames...