Description
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nghttp2 | 1.6.0-1 | — |
| Debian 13 | nghttp2 | 1.6.0-1 | — |
| Debian 12 | nghttp2 | 1.6.0-1 | — |
References
- APPLE-SA-2016-03-21-5 vendor-advisory
- GLSA-201612-06 vendor-advisory
- https://support.apple.com/HT206167
- https://support.apple.com/HT206168
- [oss-security] 20151223 Re: Use after free in nghttp2 mailing-list
- 1035353 vdb-entry
- [oss-security] 20151223 Use after free in nghttp2 mailing-list
- APPLE-SA-2016-03-21-1 vendor-advisory
- FEDORA-2016-54f85ec6e8 vendor-advisory
- APPLE-SA-2016-03-21-2 vendor-advisory
- https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/
- FEDORA-2016-8e13ac5754 vendor-advisory
- APPLE-SA-2016-03-21-3 vendor-advisory
- https://support.apple.com/HT206169
- https://support.apple.com/HT206166