nghttp2 -- Denial of service due to NULL pointer dereference

nghttp2 blog: If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. ALTSVC frame is defined by RFC 7838...

Unnamed Vulnerability in Apple iOS/tvOS/macOS/watchOS HTTPProtocol Component

iOS is a mobile operating system developed by Apple Inc. First announced at the Macworld conference on January 9, 2007, it was originally designed for use with the iPhone, and has since been applied to the iPod touch, iPad, and Apple TV. tvOS is an Apple-developed system based on iOS. tvOS is the...

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

Hardcoded credentials

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

CVE-2017-2428

CVE-2017-2428 affects nghttp2 before 1.17.0 in the HTTPProtocol component across Apple products (iOS <10.3, macOS <10.12.4, tvOS <10.2, watchOS

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

Apple TV < 10.2 Multiple Vulnerabilities

Binary data 700035.prm...

CVE-2017-2428: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

Mac OS X 10.x < 10.12.4 Multiple Vulnerabilities

Binary data 700032.prm...

GLSA-201612-13 : nghttp2: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201612-13 nghttp2: Denial of Service Nghttpd, nghttp, and libnghttp2asio applications do not limit the memory usage for the incoming HTTP header field. If a peer sends a specially crafted HTTP/2 HEADERS frame and CONTINUATION fram...

nghttp2: Denial of service

Background Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. Description Nghttpd, nghttp, and libnghttp2asio applications do not limit the memory usage for the incoming HTTP header field. If a peer sends a specially crafted HTTP/2 HEADERS frame and CONTINUATI...

GLSA-201612-06 : nghttp2: Heap-use-after-free

The remote host is affected by the vulnerability described in GLSA-201612-06 nghttp2: Heap-use-after-free A heap-use-after-free vulnerability has been discovered in nghttp2. Please review the CVE identifier referenced below for details. Impact : The impact of the vulnerability is still unknown...

nghttp2: Heap-use-after-free

Background Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. Description A heap-use-after-free vulnerability has been discovered in nghttp2. Please review the CVE identifier referenced below for details. Impact The impact of the vulnerability is still unknown...

nghttp2 < 1.7.0 DoS Vulnerability

nghttp2 is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nghttp2:nghttp2"; if...

nghttp2 Detection (HTTP)

Detection of nghttp2 web server The script sends a connection request to the server and attempts to detect the presence of nghttp2 and to extract its version SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Nghttp2 Local Denial of Service Vulnerability

Nghttp2 is a C library for implementing HTTP/2. A local denial of service vulnerability exists in Nghttp2, which can be exploited by a local attacker to cause an affected application to crash and deny service to legitimate users...

openSUSE Security Update : nghttp2 (openSUSE-2016-314)

This update for nghttp2 fixes the following vulnerabilities : - CVE-2016-1544: A malicious remote attacker could have caused an Out of memory condition due to unlimited incoming HTTP header fields boo966514 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Fedora 23 : nghttp2-1.7.1-1.fc23 (2016-ac861a840e)

CVE-2016-1544: Out of memory in nghttpd, nghttp, and libnghttp2asio applications due to unlimited incoming HTTP header fields: https://github.com/tatsuhiro-t/nghttp2/releases/tag/v1.7.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 22 : nghttp2-1.6.0-1.fc22 (2016-8e13ac5754)

update to nghttp2-1.6.0 fixes CVE-2015-8659 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...