CVE-2015-8659
CVE-2015-8659
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
CVSS 10.0 · Critical · EPSS 4.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- https://security.gentoo.org/glsa/201612-06
- https://support.apple.com/HT206167
- https://support.apple.com/HT206168
- http://www.openwall.com/lists/oss-security/2015/12/23/10
- http://www.securitytracker.com/id/1035353
- http://www.openwall.com/lists/oss-security/2015/12/23/6
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
- https://support.apple.com/HT206169
- https://support.apple.com/HT206166
- https://nvd.nist.gov/vuln/detail/CVE-2015-8659