kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security/vuxml: Add entry for www/nghttp2 < 1.7.1

Browse source 
- Out of memory error in nghttpd, nghttp, and libnghttp2_asio
    applications

Reviewed by:	feld (secteam, mentor)
Approved by:	feld (secteam, mentor)
Depends on:	D5218
Differential Revision:	D5271
This commit is contained in:
Bernard Spil 2016-02-14 14:39:55 +00:00
parent cf5c235ac2
commit 2baf23e640
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=408857
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
security/vuxml/vuln.xml
View file

@ -57,6 +57,38 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
due to unlimited incoming HTTP header fields.</p>
<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
for the incoming HTTP header field. If peer sends specially crafted HTTP/2
HEADERS frames and CONTINUATION frames, they will crash with out of memory
error.</p>
<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
<cvename>CVE-2016-1544</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-13</entry>
</dates>
</vuln>
<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
<topic>horde -- XSS vulnerabilies</topic>
<affects>