FreeBSD : h2o -- use after free on premature connection close (65bb1858-27de-11e6-b714-74d02b9a84d5)
High Nessus Plugin ID 91437
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionTim Newsha reports :
When H2O tries to disconnect a premature HTTP/2 connection, it calls free(3) to release memory allocated for the connection and immediately after then touches the memory. No malloc-related operation is performed by the same thread between the time it calls free and the time the memory is touched. Fixed by Frederik Deweerdt.
SolutionUpdate the affected package.