Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2011-1928HistoryMay 24, 2011 - 11:55 p.m.
CVE-2011-1928
2011-05-2423:55:00
Debian Security Bug Tracker
security-tracker.debian.org
13
6.5 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.034 Low
EPSS
Percentile
91.3%
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | apr | < 1.4.5-1 | apr_1.4.5-1_all.deb |
| Debian | 11 | all | apr | < 1.4.5-1 | apr_1.4.5-1_all.deb |
| Debian | 10 | all | apr | < 1.4.5-1 | apr_1.4.5-1_all.deb |
| Debian | 999 | all | apr | < 1.4.5-1 | apr_1.4.5-1_all.deb |
| Debian | 13 | all | apr | < 1.4.5-1 | apr_1.4.5-1_all.deb |
Related
openvas
openvas
Debian Security Advisory DSA 2237-2 (apr)
2011-08-03 00:00:00
Ubuntu: Security Advisory (USN-1134-1)
2011-06-03 00:00:00
CentOS Update for apr CESA-2011:0844 centos5 i386
2011-08-09 00:00:00
nessus
nessus
Fedora 13 : apr-1.4.5-1.fc13 (2011-7340)
2011-06-06 00:00:00
CentOS 4 / 5 : apr (CESA-2011:0844)
2011-06-02 00:00:00
Scientific Linux Security Update : apr on SL4.x, SL5.x i386/x86_64
2012-08-01 00:00:00
fedora
fedora
[SECURITY] Fedora 15 Update: apr-1.4.5-1.fc15
2011-06-02 10:55:41
[SECURITY] Fedora 14 Update: apr-1.4.5-1.fc14
2011-06-04 03:01:11
[SECURITY] Fedora 13 Update: apr-1.4.5-1.fc13
2011-06-04 03:02:07
debian
debian
[SECURITY] [DSA 2237-2] apr security update
2011-05-21 08:01:12
[SECURITY] [DSA 2237-2] apr security update
2011-05-21 08:01:12
[SECURITY] [DSA 2237-1] apr security update
2011-05-15 09:25:17
centos
centos
apr security update
2011-05-31 16:57:35
apr security update
2011-05-12 02:38:03
ubuntu
ubuntu
APR vulnerabilities
2011-05-24 00:00:00
ubuntucve
ubuntucve
CVE-2011-1928
2011-05-24 00:00:00
CVE-2011-0419
2011-05-16 00:00:00
securityvulns
securityvulns
apr / Apache mod_autoindex DoS
2011-05-21 00:00:00
[ MDVSA-2011:095 ] apr
2011-05-21 00:00:00
[SECURITY] [DSA 2237-1] apr security update
2011-05-16 00:00:00
f5
f5
SOL16879 - Apache Portable Runtime vulnerability CVE-2011-1928
2015-07-02 00:00:00
K16879 : Apache Portable Runtime vulnerability CVE-2011-1928
2015-07-02 00:00:00
K15920 : Apache vulnerability CVE-2011-0419
2014-12-18 00:00:00
redhat
redhat
(RHSA-2011:0844) Low: apr security update
2011-05-31 00:00:00
(RHSA-2011:0507) Moderate: apr security update
2011-05-11 00:00:00
(RHSA-2011:0897) Moderate: JBoss Enterprise Web Server 1.0.2 update
2011-06-22 00:00:00
prion
prion
Code injection
2011-05-24 23:55:00
Design/Logic Flaw
2011-05-16 17:55:00
cve
cve
CVE-2011-1928
2011-05-24 23:55:00
CVE-2011-0419
2011-05-16 17:55:00
veracode
veracode
Denial Of Service (DoS)
2020-04-10 01:02:57
Denial Of Service (DoS)
2020-04-10 00:58:59
freebsd
freebsd
Apache APR -- DoS vulnerabilities
2011-05-19 00:00:00
Apache APR -- DoS vulnerabilities
2011-05-10 00:00:00
Apache APR -- DoS vulnerabilities
2011-05-19 00:00:00
gentoo
gentoo
Apache Portable Runtime, APR Utility Library: Denial of service
2014-05-18 00:00:00
slackware
slackware
[slackware-security] apr/apr-util
2011-05-25 23:18:28
[slackware-security] apr/apr-util
2011-05-14 05:03:34
altlinux
altlinux
Security fix for the ALT Linux 7 package apr1 version 1.4.6-alt1
2012-11-16 00:00:00
Security fix for the ALT Linux 7 package apr1 version 1.4.4-alt1
2011-05-13 00:00:00
oraclelinux
oraclelinux
apr security update
2011-05-31 00:00:00
apr security update
2011-05-11 00:00:00
suse
suse
Security update for apache2 (important)
2011-11-09 19:08:34
exploitpack
exploitpack
Apache 1.42.2.x - APR apr_fnmatch() Denial of Service
2011-05-12 00:00:00
debiancve
debiancve
CVE-2011-0419
2011-05-16 17:55:00
checkpoint_advisories
checkpoint_advisories
Apache APR apr_fnmatch Stack Overflow Denial of Service
2011-07-15 00:00:00
Apache APR apr_fnmatch Stack Overflow Denial of Service (CVE-2011-0419)
2011-08-16 00:00:00
httpd
httpd
Apache Httpd < 2.0.65 : apr_fnmatch flaw leads to mod_autoindex remote DoS
2011-03-02 00:00:00
Apache Httpd < 2.2.19 : apr_fnmatch flaw leads to mod_autoindex remote DoS
2011-03-02 00:00:00
seebug
seebug
Apache APR 'apr_fnmatch()'拒绝服务漏洞
2011-05-13 00:00:00
exploitdb
exploitdb
Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service
2011-05-12 00:00:00
kaspersky
kaspersky
KLA10065 Multiple vulnerabilities in Apache httpd
2013-07-22 00:00:00
hackerone
hackerone
U.S. Dept Of Defense: Out-of-date Version (Apache)
2016-11-24 15:09:27
oracle
oracle
Oracle Critical Patch Update - July 2013
2013-07-16 00:00:00
Oracle Critical Patch Update - July 2012
2012-07-17 00:00:00
6.5 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.034 Low
EPSS
Percentile
91.3%
Related for DEBIANCVE:CVE-2011-1928