1039 matches found
httpd: out of bounds read
The date handling code in modules/proxy/proxyutil.c modproxy in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service caching forward proxy process crash via crafted date headers that trigger a buffer over-read...
httpd scoreboard lack of PID protection
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the workerscore and processscore arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."...
Design/Logic Flaw
The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address...
CVE-2007-3571
The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address...
CVE-2007-3571
CVE-2007-3571 affects the Apache Web Server as used in Novell NetWare 6.5 and GroupWise. The issue stems from a specific Apache directive that, when processed, alters the HTTP-Header response, which may disclose the server’s internal IP address. The NVD entry lists a partial confidentiality impac...
httpd mod_cache segfault
cacheutil.c in the modcache module in Apache HTTP Server httpd, when caching is enabled and a threaded Multi-Processing Module MPM is used, allows remote attackers to cause a denial of service child processing handler crash via a request with the 1 s-maxage, 2 max-age, 3 min-fresh, or 4 max-stale...
httpd mod_status XSS
Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...
httpd scoreboard lack of PID protection
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the workerscore and processscore arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."...
Low: Red Hat Security Advisory: mod_perl security update
Updated modperl packages that fix a security issue are now available for Red Hat Application Stack. This update has been rated as having low security impact by the Red Hat Security Response Team. Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can...
Low: Red Hat Security Advisory: mod_perl security update
Updated modperl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web...
[SECURITY] Fedora Core 6 Update: mod_perl-2.0.2-6.2.fc6
Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl runtime library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a quick...
[SECURITY] Fedora Core 5 Update: mod_perl-2.0.2-5.2.fc5
Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl runtime library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a quick...
[SECURITY] Fedora 7 Update: mod_perl-2.0.3-9.1.fc7
Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl runtime library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a quick...
mod_jk sends decoded URL to tomcat
modjk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. dot dot sequences and...
SOL6669 - Apache HTTP Expect header handling
The vulnerability exists in the Apache web server, which is used by FirePass. Apache will not sanitize the contents of the HTTP Expect header when receiving an HTTP request. Instead, the contents of the Expect header will be returned in a successful HTTP response. This permits executable code suc...
[SECURITY] Fedora Core 5 Update: php-5.1.6-1.5
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
[SECURITY] Fedora Core 5 Update: php-5.1.6-1.4
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
PT-2007-1571
Name of the Vulnerable Software and Affected Versions Apache HTTP Server affected versions not specified Description The issue allows remote attackers to cause a denial of service, consuming network bandwidth, via a Range header that specifies multiple copies of the same fragment when accessed...
PT-2006-1096
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.54 and earlier Description: A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the...
