Lucene search

GoogleOSV:CVE-2018-25103

HistoryJun 17, 2024 - 6:15 p.m.

CVE-2018-25103

2024-06-1718:15:12

Google

osv.dev

use-after-free

lighttpd

request parsing

memory pointer

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

10.6%

JSON

There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.

References

9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf

blogvdoo.wordpress.com/2018/11/06/giving-back-securing-open-source-iot-projects/#more-736

github.com/lighttpd/lighttpd1.4/commit/d161f53de04bc826ce1bdaeb3dce2c72ca50a3f8

github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b1148e9

security-tracker.debian.org/tracker/CVE-2018-25103

www.kb.cert.org/vuls/id/312260

www.runzero.com/blog/lighttpd/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

10.6%

JSON

Related for OSV:CVE-2018-25103