78 matches found
Nginx < 1.4.7 SPDY Heap Buffer Overflow
According to the self-reported version in the server response header, the installed 1.3.x version of nginx is 1.3.15 or higher, or 1.4.x prior to 1.4.7, or 1.5.x prior to 1.5.12. It is, therefore, affected by a heap buffer overflow vulnerability. A flaw exists with the SPDY protocol implementatio...
CVE-2016-7475
Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel TMM may not properly clean-up pool member network connections when using SPDY or HTTP/2 virtual server profiles...
CVE-2016-7475
Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel TMM may not properly clean-up pool member network connections when using SPDY or HTTP/2 virtual server profiles...
Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-09412)
F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. Security vulnerabilities exist in several F5 products. An attacker can exploit this vulnerability by sending malformed SPDY or HTTP/2 requests to...
SSL/TLS: TLS/SPDY Protocol Information Disclosure Vulnerability (CRIME)
The TLS/SPDY protocols are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
F5 Networks BIG-IP : CRIME vulnerability via the SPDY protocol (K14059)
The SPDY protocol 3, and earlier, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences during a series of guesses in which a string i...
What is HTTP/2 ? Next-Gen Protocol For Faster and Safer Internet
Good news for Internet folks! Get Ready as the entire web you know is about to change. The new and long-awaited version of HTTP took a major step toward becoming a reality on Wednesday – It is been officially finalized and approved. Mark Nottingham, chairman of the Internet Engineering Task Force...
Debian Security Advisory DSA 3039-1 (chromium-browser - security update)
Several vulnerabilities were discovered in the chromium web browser. CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching. CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium...
Debian DSA-3039-1 : chromium-browser - security update
Several vulnerabilities were discovered in the chromium web browser. - CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching. - CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium...
UBUNTU-CVE-2014-3166
The Public Key Pinning PKP implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of...
[SECURITY] [DSA 2959-1] chromium-browser security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2959-1 [email protected] http://www.debian.org/security/ Michael Gilbert June 14, 2014 http://www.debian.org/security/faq -...
Debian Security Advisory DSA 2959-1 (chromium-browser - security update)
Several vulnerabilities have been discovered in the chromium web browser. CVE-2014-3154 Collin Payne discovered a use-after-free issue in the filesystem API. CVE-2014-3155 James March, Daniel Sommermann, and Alan Frindell discovered several out-of-bounds read issues in the SPDY protocol...
DSA-2959-1 chromium-browser - security update
Bulletin has no description...
CRIME vulnerability via the SPDY protocol CVE-2012-4930
The SPDY protocol 3, and earlier, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences during a series of guesses in which a string i...
SOL14059 - CRIME vulnerability via the SPDY protocol CVE-2012-4930
The SPDY protocol 3, and earlier, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences during a series of guesses in which a string i...
Transport Layer Security (TLS) Protocol CRIME Vulnerability
The remote service has one of two configurations that are known to be required for the CRIME attack : - SSL / TLS compression is enabled. - TLS advertises the SPDY protocol earlier than version 4. Note that Nessus did not attempt to launch the CRIME attack against the remote service. C Tenable...
SPDY protocol <=3 协议信息泄露漏洞
CVE ID:CVE-2012-4930 SPDY是Google开发的基于传输控制协议TCP的应用层协议。 Mozilla Firefox, Google Chrome及其他多个产品使用的SPDY协议3，执行压缩数据加密时没有正确模糊未加密数据的长度，可通过中间人攻击的攻击者可通过提交一系列猜测请求，观察到压缩数据长度的变化也称CRIME攻击来获得明文HTTP头信息，造成敏感信息泄露如cookie信息。 0 SPDY protocol 3及之前版本 厂商解决方案 用户可参考如下供应商获得最新版本的产品： http://www.google.com/chrome...
CVE-2012-4930
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing...
CVE-2012-4930
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing...
Design/Logic Flaw
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing...