CVE-2015-8659 (CRITICAL 10.0) · Watchpost

← All vulnerabilities

CVE-2015-8659

CRITICAL 10.0CVE-2015-8659 · Published 12/01/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
nghttp2 nghttp2	`≤ 1.5.0`	No fix yet

Description

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.

References

lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html
lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html
openwall.com/lists/oss-security/2015/12/23/10
openwall.com/lists/oss-security/2015/12/23/6
securitytracker.com/id/1035353
nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0 · Patch
security.gentoo.org/glsa/201612-06
support.apple.com/HT206166 · Vendor Advisory
support.apple.com/HT206167 · Vendor Advisory
support.apple.com/HT206168 · Vendor Advisory
support.apple.com/HT206169 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free