diff options
| author | Bernard Spil <brnrd@FreeBSD.org> | 2016-02-14 14:39:55 +0000 |
|---|---|---|
| committer | Bernard Spil <brnrd@FreeBSD.org> | 2016-02-14 14:39:55 +0000 |
| commit | 2baf23e640510db254b69ce81d2a82c041b995dc (patch) | |
| tree | 1fb7ab90433ebf077adcaf9ae08888fd2a46020a | |
| parent | games/tome4: update 1.4.2 -> 1.4.3 (diff) | |
security/vuxml: Add entry for www/nghttp2 < 1.7.1
- Out of memory error in nghttpd, nghttp, and libnghttp2_asio
applications
Reviewed by: feld (secteam, mentor)
Approved by: feld (secteam, mentor)
Depends on: D5218
Differential Revision: D5271
Notes
Notes:
svn path=/head/; revision=408857
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index b65ed7f977a7..93ccf7cc8878 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -57,6 +57,38 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf"> + <topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic> + <affects> + <package> + <name>nghttp2</name> + <range><lt>1.7.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Nghttp2 reports:</p> + <blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/"> + <p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications + due to unlimited incoming HTTP header fields.</p> + <p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage + for the incoming HTTP header field. If peer sends specially crafted HTTP/2 + HEADERS frames and CONTINUATION frames, they will crash with out of memory + error.</p> + <p>Note that libnghttp2 itself is not affected by this vulnerability.</p> + </blockquote> + </body> + </description> + <references> + <url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url> + <cvename>CVE-2016-1544</cvename> + </references> + <dates> + <discovery>2016-02-03</discovery> + <entry>2016-02-13</entry> + </dates> + </vuln> + <vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5"> <topic>horde -- XSS vulnerabilies</topic> <affects> |