Page MenuHomeFreeBSD
Files F150511964

D12763.diff
No OneTemporary
Actions

D12763.diff
View Options

Index: head/security/vuxml/vuln.xml
===================================================================
--- head/security/vuxml/vuln.xml
+++ head/security/vuxml/vuln.xml
@@ -58,6 +58,38 @@
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
+ <topic>h2o -- DoS in workers</topic>
+ <affects>
+ <package>
+ <name>h2o</name>
+ <range><lt>2.2.3</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Frederik Deweerdt reports:</p>
+ <blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
+ <p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
+ see references for full details.</p>
+ <p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
+ <p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2017-10868</cvename>
+ <cvename>CVE-2017-10869</cvename>
+ <url>https://github.com/h2o/h2o/issues/1459</url>
+ <url>https://github.com/h2o/h2o/issues/1460</url>
+ <url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
+ </references>
+ <dates>
+ <discovery>2017-07-19</discovery>
+ <entry>2017-10-17</entry>
+ </dates>
+ </vuln>
+
<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>

File Metadata

Mime Type
text/plain
Expires
Thu, Apr 2, 9:15 PM (4 h, 52 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
30736727
Default Alt Text
D12763.diff (1 KB)

Event Timeline