OSV-2022-139

    Dashboard / Vulnerabilities / OSV-2022-139

    OSV-2022-139

    Published: 11 Feb 2022Last Modified: 13 Apr 2022

    Summary: Heap-use-after-free in nghttp2_http_record_request_method

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44516 ``` Crash type: Heap-use-after-free READ 4 Crash state: nghttp2_http_record_request_method nghttp2_session_mem_send_internal nghttp2_session_send ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44516

    Affected packages

    Package

    Name: curl

    Purl: pkg:generic/curl

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9f985a11e794fdd2e175a4ea9ceb9d922a3400cd
    Fixed -2a1951519e78c1aa404ec0201b9eaeae469d757b

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2022-139 | CVE-DB