The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

OSVersionArchitecturePackageVersionFilename
Debian12allapache2< 2.4.9-1apache2_2.4.9-1_all.deb
Debian11allapache2< 2.4.9-1apache2_2.4.9-1_all.deb
Debian10allapache2< 2.4.9-1apache2_2.4.9-1_all.deb
Debian999allapache2< 2.4.9-1apache2_2.4.9-1_all.deb
Debian13allapache2< 2.4.9-1apache2_2.4.9-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	apache2	< 2.4.9-1	apache2_2.4.9-1_all.deb
Debian	11	all	apache2	< 2.4.9-1	apache2_2.4.9-1_all.deb
Debian	10	all	apache2	< 2.4.9-1	apache2_2.4.9-1_all.deb
Debian	999	all	apache2	< 2.4.9-1	apache2_2.4.9-1_all.deb
Debian	13	all	apache2	< 2.4.9-1	apache2_2.4.9-1_all.deb

httpd 2

f5 2

veracode 1

cve 1

prion 1

nessus 42

ubuntucve 1

openvas 31

ibm 7

kaspersky 1

threatpost 1

seebug 1

centos 2

slackware 1

freebsd 1

redhat 6

oraclelinux 2

securityvulns 7

mageia 1

fedora 1

amazon 1

ubuntu 1

gentoo 1

osv 1

suse 5

debian 1

hackerone 2

oracle 2

httpd

Apache Httpd < 2.4.9 : mod_dav crash

2013-12-10 00:00:00

Apache Httpd < 2.2.27 : mod_dav crash

2013-12-10 00:00:00

SOL15300 - Apache HTTP Server mod_dav DoS vulnerability CVE-2013-6438

2014-06-02 00:00:00

K15300 : Apache HTTP Server mod_dav DoS vulnerability CVE-2013-6438

2014-12-12 00:00:00

veracode

Denial Of Service (Dos)

2019-01-15 08:54:20

cve

CVE-2013-6438

2014-03-18 05:18:00

prion

Cross site request forgery (csrf)

2014-03-18 05:18:00

nessus

IBM HTTP Server 7.0.0.0 < 7.0.0.33 / 8.0.0.0 < 8.0.0.9 / 8.5.0.0 < 8.5.5.2 Buffer Overflow (244199)

2020-12-15 00:00:00

FreeBSD : apache -- several vulnerabilities (91ecb546-b1e6-11e3-980f-20cf30e32f6d)

2014-03-24 00:00:00

Apache HTTP Server < 2.4.8 Multiple Vulnerabilities

2014-03-20 00:00:00

ubuntucve

CVE-2013-6438

2014-03-18 00:00:00

openvas

RedHat Update for httpd RHSA-2014:0370-01

2014-04-08 00:00:00

CentOS Update for httpd CESA-2014:0370 centos6

2014-04-08 00:00:00

Oracle: Security Advisory (ELSA-2014-0370)

2015-10-06 00:00:00

ibm

Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, and 2050 are affected by the following Apache Tomcat vulnerabilities: CVE-2014-0098 and CVE-2013-6438

2018-06-16 13:57:53

Security Bulletin: Network Intrusion Prevention System is affected by multiple Apache web server vulnerabilities (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)

2022-02-23 19:21:55

Security Bulletin: Vulnerabilities in Apache affect the IBM Flex System Manager (FSM): (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)

2019-01-31 01:35:01

kaspersky

KLA10067 DoS vulnerabilities in Apache httpd

2014-03-26 00:00:00

threatpost

Apache Update Resolves Security Vulnerabilities

2014-03-18 12:51:25

seebug

Apache HTTP Server多个拒绝服务漏洞

2014-03-20 00:00:00

centos

httpd, mod_ssl security update

2014-04-04 00:08:57

httpd, mod_ssl security update

2014-04-04 00:04:54

slackware

[slackware-security] httpd

2014-03-28 22:54:00

freebsd

apache -- several vulnerabilities

2014-02-25 00:00:00

redhat

(RHSA-2014:0783) Moderate: Red Hat JBoss Web Server 2.0.1 httpd security and bug fix update

2014-06-23 17:50:43

(RHSA-2014:0369) Moderate: httpd security update

2014-04-03 00:00:00

(RHSA-2014:0370) Moderate: httpd security update

2014-04-03 00:00:00

oraclelinux

httpd security update

2014-04-03 00:00:00

httpd security update

2014-04-03 00:00:00

securityvulns

[ MDVSA-2014:065 ] apache

2014-03-24 00:00:00

Apache security vulnerabilities

2014-03-24 00:00:00

APPLE-SA-2014-10-16-1 OS X Yosemite v10.10

2014-10-18 00:00:00

mageia

Updated apache packages fix security vulnerabilities

2014-03-19 21:40:14

fedora

[SECURITY] Fedora 19 Update: httpd-2.4.9-1.fc19

2014-04-23 04:33:29

amazon

Medium: httpd

2014-04-25 16:00:00

ubuntu

Apache HTTP Server vulnerabilities

2014-03-24 00:00:00

gentoo

Apache HTTP Server: Multiple vulnerabilities

2014-08-29 00:00:00

osv

apache2 - security update

2014-09-29 00:00:00

suse

Security update for the Apache Web Server (important)

2014-08-07 01:04:17

Security update for apache2 (important)

2014-09-02 19:04:20

Security update for apache2 (important)

2014-09-02 20:04:23

debian

[SECURITY] [DLA 66-1] apache2 security update

2014-09-29 13:40:41

hackerone

Marktplaats: Multiple Apache 2.2.22 Vulnerabilities (XSS/ Code Exec/ DoS)

2015-06-09 17:47:58

U.S. Dept Of Defense: Out-of-date Version (Apache)

2016-11-24 15:09:27

oracle

Oracle Critical Patch Update - July 2014

2014-07-15 00:00:00

Oracle Critical Patch Update Advisory - January 2015

2015-03-10 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.035 Low

EPSS

Percentile

91.5%

JSON

Related for DEBIANCVE:CVE-2013-6438