DEBIAN-CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

DEBIAN-CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

EUVD-2016-5947

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

PT-2016-6205

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.18 through 2.4.20 Description The issue allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation,...

CVE-2016-4817

lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service use-after-free and application crash or possibly execute arbitrary code via a crafted packet...

CVE-2016-4817

H2O vulnerability CVE-2016-4817 affects lib/http2/connection.c: disconnection handling causes a use-after-free in HTTP/2 processing. A crafted packet can lead to denial of service (application crash) and possibly arbitrary code execution. Affected versions are H2O before 1.7.3 and 2.x before 2.0....

PT-2016-6161

Name of the Vulnerable Software and Affected Versions H2O versions 1.7.3 and earlier H2O versions 2.x before 2.0.0-beta5 Description The issue is related to the mishandling of HTTP/2 disconnection in the lib/http2/connection.c file. This allows remote attackers to cause a denial of service,...

CVE-2016-4817: Undefined Security Weakness

lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service use-after-free and application crash or possibly execute arbitrary code via a crafted packet...

openSUSE Security Update : go (openSUSE-2016-606)

This go update to version 1.6 fixes the following issues : Security issues fixed : - CVE-2016-3959: Infinite loop in several big integer routines boo974232 - CVE-2015-8618: Carry propagation in Int.Exp Montgomery code in math/big library boo960151 Bugs fixed : - Update to version 1.6 : - On Linux...

WYSIWYG Network Packet Editor: WireEdit

WYSIWYG Network Packet Editor WireEdit is first-of-a-kind and the only full stack cross-platform WYSIWYG network packets editor. It allows editing packets data at all stack layers as “rich text” in a simple point-and-click interface. The input and output format is Pcap. Is WireEdit a Pcap Editor?...

Code injection

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

CVE-2016-2525

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

CVE-2016-2525: Improper Input Validation

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service memory consumption or application crash via a crafted packet...

Apache Traffic Server 5.3.x < 5.3.2 HTTP2 Multiple Vulnerabilities

Binary data 9071.prm...

UBUNTU-CVE-2015-7219

The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service integer underflow, assertion failure, and application exit via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation...

KLA10723 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to spoof user interface, cause denial of service, bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list ...

Fedora 22 : php-5.6.8-1.fc22 (2015-6195)

16 Apr 2015, PHP 5.6.8 Core : - Fixed bug 66609 php crashes with get and ++ operator in some cases. Dmitry, Laruence - Fixed bug 68021 getbrowser browsernameregex returns non-utf-8 characters. Tjerk - Fixed bug 68917 parseurl fails on some partial urls. Wei Dai - Fixed bug 69134 Per Directory...

io.undertow:undertow-http2-test-suite (>=1.2.0.beta1, <=1.2.0.beta2), io.undertow:undertow-servlet (>=1.2.0.beta1, <=1.2.0.beta2) +2 more potentially affected by CVE-2014-7816 via io.undertow:undertow-core (>=1.2.0.beta1, <=1.2.0.beta2)

io.undertow:undertow-core MAVEN version =1.2.0.beta1, =1.2.0.beta1, =1.2.0.beta1, =1.2.0.beta1, =1.0.0.alpha9, =1.0.0.alpha10 Source cves: CVE-2014-7816 Source advisory: MEND:CVE-2014-7816...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-http2-test-suite (>=1.1.0.beta7, <=1.1.0.beta8) +4 more potentially affected by CVE-2014-7816 via io.undertow:undertow-core (>=1.1.0.beta1, <=1.1.0.cr4)

io.undertow:undertow-core MAVEN version =1.1.0.beta1, =1.1.0.beta7, =1.1.0.beta1, =1.1.0.beta1, =1.0.0.alpha1, =1.0.0.alpha8 Source cves: CVE-2014-7816 Source advisory: MEND:CVE-2014-7816...