Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability in Apache2

A memory allocation vulnerability with an excessive size value in Apache HTTP Server’s modhttp leads to a denial of service due to malicious HTTP requests. This issue affects Apache HTTP Server versions 2.4.17 through 2.4.67...

Astra Linux – Vulnerability in Apache2

A carefully crafted request body can cause a read to a random memory area, which may lead to the process crashing. This issue affects Apache HTTP Server 2.4.52 and earlier...

Astra Linux – Vulnerability in Apache2

Some modproxy configurations on the Apache HTTP Server versions 2.4.0 through 2.4.55 allow for an HTTP Request Smuggling attack. These configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch, where a non-specific pattern matches a portion of the...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modproxyajp module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.66. Users are recommended to upgrade to version 2.4.67, as this fix addresses the vulnerability...

Astra Linux – Vulnerability in Apache2

Buffer Over-read vulnerability in Apache HTTP Server due to outbound OCSP requests sent to an attacker-controlled OCSP server This issue affects Apache HTTP Server versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which addresses this vulnerability...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the Apache HTTP Server with modheaders and modmime, involving multiple response languages. This issue affects the Apache HTTP Server version 2.4.0 through 2.4.67...

Astra Linux – Vulnerability in Apache2

Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server up to version 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes this vulnerability...

Astra Linux – Vulnerability in Apache2

Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in modproxyajp of the Apache HTTP Server allows an attacker to secretly send requests to the AJP server to which the server forwards requests. This issue affects the Apache HTTP Server version 2.4.54 and...

Astra Linux – Vulnerability in Apache2

apescapequotes may write beyond the end of a buffer when given malicious input. None of the included modules passes untrusted data to these functions, but third-party/external modules may do so. This issue affects Apache HTTP Server 2.4.48 and earlier...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modmacro module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.57...

Astra Linux – Vulnerability in Apache2

A privilege management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server versions from 2.4.67 onwards. Users are recommended to upgrade to version 2.4.68, which fixes thi...

Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server, that malicious AJP server can send a malicious AJP message back to modproxyajp, causing it to write 4 bytes controlled by the attacker after the end of a heap-based...

Astra Linux – Vulnerability in Apache2

“Use After Free” vulnerability in Apache HTTP Server with modldap, in per-directory configuration This issue affects Apache HTTP Server: from version 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability in Apache2

A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd team is not aware of an exploit for this vulnerability, but it might be possible to create one. This issue affects Apache HTTP Server 2.4.51 and earlie...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...