CVE-2015-3249 The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary c...
CriticalCVSS 9.8
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/trafficserver(Debian:12) | < 5.3.1-1 | 5.3.1-1 |
| apache traffic server | = 5.3.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-3249 vendor-advisory
- [www-announce] 20150704 [ANNOUNCE] Apache Traffic Server 5.3.1 is released! mailing-list
- 101631 third-party-advisory vdb-entry
- yahoo-security.tumblr.com issue-tracking third-party-advisory