CVE-2015-8659

Key facts

CVSS score

10.0 (v3.0)

Severity

CRITICAL

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness (CWE)

CWE-119

EPSS score

4.0% (90th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2015-8536)

Published

January 12, 2016

NVD last modified

June 17, 2026

Status

Modified

Affected products

• apple / iphone os
• apple / mac os x
• apple / tvos
• apple / watchos
• nghttp2 / nghttp2

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Apple Mac OS X 10.6 - Apple Inc. - Common Criteria BSI-DSZ-CC-0536-2010 - archived
• Apple Mac OS X v10.3.6 and Apple Mac OS X Server V10.3.6 - Apple Inc. - Common Criteria CCEVS-VR-0086-2005 - archived

References

• http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175085.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175423.html
• http://www.openwall.com/lists/oss-security/2015/12/23/10
• http://www.openwall.com/lists/oss-security/2015/12/23/6
• http://www.securitytracker.com/id/1035353
• https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/(Patch, Vendor Advisory)
• https://security.gentoo.org/glsa/201612-06
• https://support.apple.com/HT206166(Vendor Advisory)
• https://support.apple.com/HT206167(Vendor Advisory)
• https://support.apple.com/HT206168(Vendor Advisory)
• https://support.apple.com/HT206169(Vendor Advisory)