What is CVE-2015-8659?

CVE-2015-8659 is a critical-severity vulnerability in Apple Iphone_os, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 10.0/10. Published 2016-01-12.

How severe is CVE-2015-8659?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Buffer overflow in Apple Iphone_os

CVE-2015-8659

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.

Vulnerability class: Buffer Overflow

EPSS: 0.022 (84.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

APPLE-SA-2016-03-21-5 (vendor-advisory, x_refsource_APPLE)
GLSA-201612-06 (vendor-advisory, x_refsource_GENTOO)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
[oss-security] 20151223 Re: Use after free in nghttp2 (mailing-list, x_refsource_MLIST)
1035353 (vdb-entry, x_refsource_SECTRACK)
[oss-security] 20151223 Use after free in nghttp2 (mailing-list, x_refsource_MLIST)
APPLE-SA-2016-03-21-1 (vendor-advisory, x_refsource_APPLE)
FEDORA-2016-54f85ec6e8 (x_refsource_FEDORA, vendor-advisory)
APPLE-SA-2016-03-21-2 (vendor-advisory, x_refsource_APPLE)

Frequently asked questions

What is CVE-2015-8659?: CVE-2015-8659 is a critical-severity vulnerability in Apple Iphone_os, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 10.0/10. Published 2016-01-12.
How severe is CVE-2015-8659?: Critical severity. CVSS v3 base score is 10.0 out of 10.