Base Score

CRITICAL10

CVE-2015-8659

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.

VectorNETWORK

Published Bycve@mitre.org

Published DateJan 12, 2016, 19:59

Weakness Type (CWE):CWE-119

CVSS Metrics

Base Score

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html
http://www.openwall.com/lists/oss-security/2015/12/23/10
http://www.openwall.com/lists/oss-security/2015/12/23/6
http://www.securitytracker.com/id/1035353
https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/
https://security.gentoo.org/glsa/201612-06
https://support.apple.com/HT206166
https://support.apple.com/HT206167
https://support.apple.com/HT206168
https://support.apple.com/HT206169

Base Score

CRITICAL10

Weakness Type (CWE):CWE-119

CVSS Metrics

Base Score

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH