FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  518000
Date:      2019-11-20
Time:      10:57:40Z
Committer: zeising

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
10c0fabc-b5da-11e7-816e-00bd5d1fff09h2o -- DoS in workers

Frederik Deweerdt reports:

Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details.

CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.

CVE-2017-10869: The stack may overflow when proxying huge requests.


Discovery 2017-07-19
Entry 2017-10-17
h2o
lt 2.2.3

CVE-2017-10868
CVE-2017-10869
https://github.com/h2o/h2o/issues/1459
https://github.com/h2o/h2o/issues/1460
https://github.com/h2o/h2o/releases/tag/v2.2.3
31ea7f73-5c55-11e5-8607-74d02b9a84d5h2o -- directory traversal vulnerability

Yakuzo reports:

H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL normalization logic.

When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive.

H2O version 1.4.5 and version 1.5.0-beta2 have been released to address this vulnerability.

Users are advised to upgrade their servers immediately.

The vulnerability was reported by: Yusuke OSUMI.


Discovery 2015-09-14
Entry 2015-09-16
h2o
lt 1.4.5

CVE-2015-5638
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638
6c808811-bb9a-11e5-a65c-485d605f4717h2o -- directory traversal vulnerability

Yakuzo OKU reports:

When redirect directive is used, this flaw allows a remote attacker to inject response headers into an HTTP redirect response.


Discovery 2016-01-13
Entry 2016-01-15
h2o
lt 1.6.2

CVE-2016-1133
https://h2o.examp1e.net/vulnerabilities.html
73b1e734-c74e-11e9-8052-0028f8d09152h2o -- multiple HTTP/2 vulnerabilities

Jonathon Loomey of Netflix reports:

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:

  • CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
  • CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
  • CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.

Discovery 2019-08-13
Entry 2019-08-25
h2o
lt 2.2.6

https://github.com/h2o/h2o/issues/2090
https://www.kb.cert.org/vuls/id/605641/
CVE-2019-9512
CVE-2019-9514
CVE-2019-9515
ce39379f-7eb7-11e8-ab03-00bd7f19ff09h2o -- heap buffer overflow during logging

Marlies Ruck reports:

Fix heap buffer overflow while trying to emit access log - see references for full details.

CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.


Discovery 2018-06-01
Entry 2018-07-03
h2o
lt 2.2.5

CVE-2018-0608
https://github.com/h2o/h2o/issues/1775
https://github.com/h2o/h2o/releases/tag/v2.2.5
65bb1858-27de-11e6-b714-74d02b9a84d5h2o -- use after free on premature connection close

Tim Newsha reports:

When H2O tries to disconnect a premature HTTP/2 connection, it calls free(3) to release memory allocated for the connection and immediately after then touches the memory. No malloc-related operation is performed by the same thread between the time it calls free and the time the memory is touched. Fixed by Frederik Deweerdt.


Discovery 2016-05-17
Entry 2016-06-01
h2o
lt 1.7.3

https://h2o.examp1e.net/vulnerabilities.html
d0b12952-cb86-11e6-906f-0cc47a065786h2o -- Use-after-free vulnerability

Kazuho Oku reports:

A use-after-free vulnerability exists in H2O up to and including version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to mount DoS attacks and / or information theft.


Discovery 2016-09-09
Entry 2016-12-29
h2o
lt 2.0.4_2

https://github.com/h2o/h2o/releases/tag/v2.0.5
https://github.com/h2o/h2o/issues/1144
08664d42-7989-11e6-b7a8-74d02b9a84d5h2o -- fix DoS attack vector

Frederik Deweerdt reported a denial-of-service attack vector due to an unhandled error condition during socket connection.


Discovery 2016-06-09
Entry 2016-09-14
h2o
lt 2.0.4

https://github.com/h2o/h2o/issues/1077
CVE-2016-4864