USN-3425-1: Apache HTTP Server vulnerability

Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue is known as Optionsbleed...

USN-3425-1 apache2 vulnerability

Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue is known as Optionsbleed...

Risks Limited With Latest Apache Bug, Optionsbleed

Servers running Apache software are susceptible to memory leaks that an attacker could theoretically piece together to learn secrets transmitted during a session. But the risk is most pressing only in shared hosting environments apparently, and only if the software is running a certain rare...

Apache httpd Limit Command Information Disclosure Vulnerability

Apache HTTP Server is an open source web server from the Apache Software Foundation. A security vulnerability in the Limit directive set in the Apache HTTP Server user .htaccess file allows remote attackers to exploit the vulnerability to construct malicious requests and obtain sensitive memory...

Amazon Linux AMI : httpd24 / httpd (ALAS-2017-896) (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret...

ALPINE-CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

DEBIAN-CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

UBUNTU-CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

Product update: Virtuozzo 7.0 Update 5 Hotfix 2 (7.0.5-642)

The Hotfix 2 for Virtuozzo 7.0 Update 5 provides stability and usability bug fixes. Vulnerability id: PSBM-70653 Unable to connect network adapter to a running VM. Vulnerability id: PSBM-70557 Ghost file limit was ignored when migrating containers. Vulnerability id: PSBM-70551 plooptrim could ent...

DEBIAN-CVE-2017-14316

A parameter verification issue was discovered in Xen through 4.9.x. The function allocheappages allows callers to specify the first NUMA node that should be used for allocations through the memflags parameter; the node is extracted using the MEMFgetnode macro. While the function checks to see if...

ALPINE-CVE-2017-14316

A parameter verification issue was discovered in Xen through 4.9.x. The function allocheappages allows callers to specify the first NUMA node that should be used for allocations through the memflags parameter; the node is extracted using the MEMFgetnode macro. While the function checks to see if...

SimpleSAMLphp Invalid Token Creation and Validation Vulnerability

SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider functionality . A security vulnerability exists in SimpleSAMLphp 1.14.14 and earlier versions of SimpleSAMLAuthTimeLimitedToken. An attacker can exploit the vulnerability t...

Beware! Viral Sarahah App Secretly Steals Your Entire Contact List

Are you also one of those 18 Million users using SARAHAH? You should beware of this app because the anonymous feedback application may not be as private as it really sounds. Sarahah is a newly launched app that has become one of the hottest iPhone and Android apps in the past couple of weeks,...

BSA-2017-360

Security Advisory ID : BSA-2017-360 Component : Linux Kernel Revision : 2.0: Interim The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMITSTACK is set to RLIMITINFINITY and 1 Gigabyte of memory is allocated the maximum under the 1/4 restriction then the stack will b...

Denial-of-Service (DoS) Through Memory Exhaustion

ImageMagick is vulnerable to denial of service DoS attacks through memory exhaustion. The loadlevel function in coders/xcf.c does not validate offsets, allowing a malicious user to pass a xcf file to allocate over the memory limit and consume all the application's memory...

Unikrn: Rate-limit protection get executed in the last stage of the registration process, allowing enumeration of existing account.

Summary: ====== This may be low risk impact but I need to suggest on improvement on your existing rate-limit protection on the registration page, It is an easy workaround and make the current protection more secure. Description: ======== Unikrn increases the registration security by requiring use...

DEBIAN-CVE-2017-13140

In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service application hang in LockSemaphoreInfo via a PNG file with a width equal to MAGICKWIDTHLIMIT...

Fuze Patches TPN Handset Vulnerabilties

Fuze, a maker of popular enterprise-grade voice-over-IP handsets, earlier this year patched three vulnerabilities that exposed user account information and enabled unauthorized authentication. The issues were made public today by researchers at Rapid7 who privately disclosed the flaws on April 12...