Vulnerabilities for Proxygen (...) - CXSECURITY.COM

Vulnerabilities for 'Proxygen'

2021-03-15

CVE-2021-24029

CWE-617

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

2020-05-18

CVE-2020-1897

CWE-416

A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.

2019-12-04

CVE-2019-11940

CWE-416

In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.

2019-07-25

CVE-2019-11921

CWE-787

An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.

2018-12-31

CVE-2018-6343

CWE-20

Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.

>>> Vendor: Facebook 26 Products

Facebook messenger

Instaroid - instagram viewer

Hiphop virtual machine

Facebook for woocommerce

React-dev-utils

Copyright 2024, cxsecurity.com