FreeBSD Bugzilla – Attachment 170902 Details for
Bug 209926
www/h2o: update 1.7.2 to 1.7.3, incl security/vuxml/xuln.xml for CVE-2016-4817
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
v1 patch
ba79e716e7fb50cb095b4aec686e86368668b398.patch (text/plain), 2.59 KB, created by
Dave Cottlehuber
on 2016-06-01 10:18:32 UTC
(
hide
)
Description:
v1 patch
Filename:
MIME Type:
Creator:
Dave Cottlehuber
Created:
2016-06-01 10:18:32 UTC
Size:
2.59 KB
patch
obsolete
>From ba79e716e7fb50cb095b4aec686e86368668b398 Mon Sep 17 00:00:00 2001 >From: Dave Cottlehuber <dch@skunkwerks.at> >Date: Wed, 1 Jun 2016 09:49:22 +0000 >Subject: [PATCH] www/h2o: update 1.7.2 to 1.7.3 to fix CVE-2016-4817 > >--- > security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ > www/h2o/Makefile | 2 +- > www/h2o/distinfo | 6 +++--- > 3 files changed, 34 insertions(+), 4 deletions(-) > >diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml >index dc12b31..8430ea0 100644 >--- a/security/vuxml/vuln.xml >+++ b/security/vuxml/vuln.xml >@@ -58,6 +58,36 @@ Notes: > * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) > --> > <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> >+ <vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5"> >+ <topic>h2o -- use after free on premature connection close</topic> >+ <affects> >+ <package> >+ <name>h2o</name> >+ <range><lt>1.7.3</lt></range> >+ </package> >+ </affects> >+ <description> >+ <body xmlns="http://www.w3.org/1999/xhtml"> >+ <p>Tim Newsha reports:</p> >+ <blockquote cite="http://h2o.examp1e.net/vulnerabilities.html"> >+ <p>When H2O tries to disconnect a premature HTTP/2 connection, it >+ calls free(3) to release memory allocated for the connection and >+ immediately after then touches the memory. No malloc-related >+ operation is performed by the same thread between the time it calls >+ free and the time the memory is touched. Fixed by Frederik >+ Deweerdt.</p> >+ </blockquote> >+ </body> >+ </description> >+ <references> >+ <url>https://h2o.examp1e.net/vulnerabilities.html</url> >+ </references> >+ <dates> >+ <discovery>2016-05-17</discovery> >+ <entry>2016-05-26</entry> >+ </dates> >+ </vuln> >+ > <vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b"> > <topic>nginx -- a specially crafted request might result in worker process crash</topic> > <affects> >diff --git a/www/h2o/Makefile b/www/h2o/Makefile >index d18bd7b1..4a90d1c 100644 >--- a/www/h2o/Makefile >+++ b/www/h2o/Makefile >@@ -2,7 +2,7 @@ > # $FreeBSD$ > > PORTNAME= h2o >-PORTVERSION= 1.7.2 >+PORTVERSION= 1.7.3 > DISTVERSIONPREFIX= v > CATEGORIES= www > >diff --git a/www/h2o/distinfo b/www/h2o/distinfo >index 82f6caf..ae6d9fe 100644 >--- a/www/h2o/distinfo >+++ b/www/h2o/distinfo >@@ -1,3 +1,3 @@ >-TIMESTAMP = 1463131188 >-SHA256 (h2o-h2o-v1.7.2_GH0.tar.gz) = fd75eab905dff9bcfd6c9c45d83a4cd0c133cc82a7d3dd48537244b12c2327a8 >-SIZE (h2o-h2o-v1.7.2_GH0.tar.gz) = 6541718 >+TIMESTAMP = 1464774475 >+SHA256 (h2o-h2o-v1.7.3_GH0.tar.gz) = 546bcde8aa3cf996d161d1e75aaad159d10fca1b3d368c4270f0674e8c78a213 >+SIZE (h2o-h2o-v1.7.3_GH0.tar.gz) = 6541316
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Flags:
dch
:
maintainer-approval+
Actions:
View
|
Diff
Attachments on
bug 209926
: 170902