OSV-2022-141

    Dashboard / Vulnerabilities / OSV-2022-141

    OSV-2022-141

    Published: 11 Feb 2022Last Modified: 13 Apr 2022

    Summary: Heap-use-after-free in nghttp2_hd_deflate_hd_bufs

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44517 ``` Crash type: Heap-use-after-free READ 3 Crash state: nghttp2_hd_deflate_hd_bufs nghttp2_frame_pack_headers nghttp2_session_mem_send_internal ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44517

    Affected packages

    Package

    Name: curl

    Purl: pkg:generic/curl

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9f985a11e794fdd2e175a4ea9ceb9d922a3400cd
    Fixed -2a1951519e78c1aa404ec0201b9eaeae469d757b

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2022-141 | CVE-DB