CVE-2015-7219

CVE-2015-7219 affects Mozilla Firefox before 43.0 via the HTTP/2 implementation. A malformed PushPromise frame can trigger decompressed-buffer length miscalculation and incorrect memory allocation, leading to a denial of service (integer underflow, assertion failure, and application exit). The is...

CVE-2015-7218

CVE-2015-7218 affects Mozilla Firefox before 43.0. The HTTP/2 implementation allows remote DoS via a single-byte header frame that triggers integer underflow and incorrect memory allocation, leading to an assertion and application exit. Public advisories (e.g., Mageia/OpenSUSE/Fedora/Nessus-docum...

CVE-2015-7218

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a single-byte header frame that triggers incorrect memory allocation...

CVE-2015-7219

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation...

CVE-2015-7218: Undefined Security Weakness

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a single-byte header frame that triggers incorrect memory allocation...

CVE-2015-7219: Undefined Security Weakness

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation...

FreeBSD : mozilla -- multiple vulnerabilities (2c2d1c39-1396-459a-91f5-ca03ee7c64c6)

The Mozilla Project reports : MFSA 2015-134 Miscellaneous memory safety hazards rv:43.0 / rv:38.5 MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation MFSA 2015-137 Firefox allows...

PT-2015-2876

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 43.0 Description The issue is related to the HTTP/2 implementation, which allows remote attackers to cause a denial of service due to an integer underflow, assertion failure, and application exit. This can be...

PT-2015-2877

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 43.0 Description The issue is related to the HTTP/2 implementation, which allows remote attackers to cause a denial of service due to an integer underflow. This underflow triggers an assertion failure and...

CVE-2015-7219

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation...

CVE-2015-7218

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a single-byte header frame that triggers incorrect memory allocation...

DOS due to malformed frames in HTTP/2 — Mozilla

Security researcher Stuart Larsen reported two issues with HTTP/2 resulting in integer underflows that lead to intentional aborts when the errors are detected...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2015-134 Miscellaneous memory safety hazards rv:43.0 / rv:38.5 MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation MFSA 2015-137 Firefox allows...

Apache Traffic Server 5.3.x < 5.3.2 HTTP2 Multiple Vulnerabilities

According to its banner, the version of Apache Traffic Server running on the remote host is 5.3.x prior to 5.3.2. It is, therefore, affected by multiple vulnerabilities related to improper handling of HTTP/2 requests. An attacker can exploit these vulnerabilities to have an unspecified impact. No...

HTTP/2 Cleartext Detection

The remote host is running an HTTP server that supports HTTP/2 running over cleartext TCP h2c. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid85805; scriptversion"1.8";...

PT-2015-3354

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 5.3.x before 5.3.1 Description The issue is related to the experimental HTTP/2 feature, which allows remote attackers to cause a denial of service or possibly execute arbitrary code. This is due to out-of-bounds...

PT-2015-3320

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 5.3.x through 5.3.1 Description The issue is related to the HTTP/2 experimental feature in Apache Traffic Server. It is caused by incorrect handling of HTTP/2 requests. Exploitation of this issue may allow a remo...

PT-2015-3319

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions prior to 5.3.2 Description The issue is related to the HTTP/2 experimental feature in Apache Traffic Server, where an unspecified vulnerability exists due to incorrect handling of HTTP/2 requests. This could allo...

Mozilla Firefox < 37.0.1 HTTP/2 Alt-Svc Header SSL MitM

Binary data 8743.prm...

openSUSE Security Update : MozillaFirefox / MozillaThunderbird / mozilla-nspr (openSUSE-2015-290)

Mozilla Firefox and Thunderbird were updated to fix several important vulnerabilities. Mozilla Firefox was updated to 37.0.1. Mozilla Thunderbird was updated to 31.6.0. mozilla-nspr was updated to 4.10.8 as a dependency. The following vulnerabilities were fixed in Mozilla Firefox : - Miscellaneou...