Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Gentoo: 202203-15 Update: libxml2 Buffer-overflow Vulnerability Remediation

gentoo
Calendar Grey December 4, 2016
Dist Gentoo Esm H88
Buffer-overflow vulnerability in OpenSSL poses risks for users of Fedora, patching urgent for maintaining system security.
Nghttp2 is vulnerable to a heap-use-after-free flaw in idle stream handling code.

Summary

A heap-use-after-free vulnerability has been discovered in nghttp2. Please review the CVE identifier referenced below for details.

Topics%20covered

Topics Covered

security advisory security issue gentoo software update normal nghttp2 heap-use-after-free

Resolution

All nghttp2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/nghttp2-1.6.0"

References

[ 1 ] CVE-2015-8659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8659

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-06
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: nghttp2: Heap-use-after-free
Date: December 04, 2016
Bugs: #569518
ID: 201612-06

Topics%20covered

Topics Covered

security advisory security issue gentoo software update normal nghttp2 heap-use-after-free

Synopsis

Nghttp2 is vulnerable to a heap-use-after-free flaw in idle stream handling code.

Background

Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/nghttp2 < 1.6.0 >= 1.6.0

Impact

===== The impact of the vulnerability is still unknown.

Workaround

There is no known workaround at this time.

Your message here