449 matches found
CVE-2017-18587
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers...
CVE-2017-18587
CVE-2017-18587 (hyper crate, Rust) affects the hyper crate before 0.9.18, where header values mishandled newline characters in serialization. This can allow header fragmentation/splitting of requests or responses due to newline handling in header values. The issue is documented across multiple so...
CVE-2017-18587
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers...
CVE-2017-18587
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers...
UBUNTU-CVE-2019-10098
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL...
CVE-2019-10098
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL...
PT-2019-3477
Name of the Vulnerable Software and Affected Versions Apache HTTP server versions 2.4.0 through 2.4.39 Description The issue is related to the mod rewrite function in the Apache HTTP server, which can be fooled by encoded newlines and redirect to an unexpected URL within the request URL. This can...
Linux systemd Line Splitting
systemd: reexec state injection: fgets on overlong lines leads to line splitting CVE-2018-15686 I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When system...
Apache HTTP Server Remote Security Bypass Vulnerability
Apache HTTP Server is an open source web server from the Apache Software Foundation. A security bypass vulnerability exists in Apache httpd versions 2.2.0 through 2.4.29, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations via trailing newline...
McAfee Web Gateway Multiple Vulnerabilities (SB10205)
McAfee Web Gateway is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mcafee:webgateway";...
CVE-2017-1000368
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution...
DEBIAN-CVE-2017-1000368
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution...
Design/Logic Flaw
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution...
UBUNTU-CVE-2017-1000368
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution...
DEBIAN-CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0ad regular expression...
openSUSE Security Update : curl (openSUSE-2015-125)
was updated to version 7.40.0 to fix two security issues. These security issues were fixed : - CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allowed remote attackers to inject arbitrary HTTP headers and conduct HTTP response...
DEBIAN-CVE-2014-9116
The writeoneheader function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service crash via a header with an empty body, which triggers a heap-based buffer overflow in the muttsubstrdup function...
Python -- HTTP Header Injection in Python urllib
Guido Vranken reports: HTTP header injection in urrlib2/urllib/httplib/http.client with newlines in header values, where newlines have a semantic consequence of denoting the start of an additional header line...
DEBIAN-CVE-2014-5161
The dissectlog function in plugins/irda/packet-irda.c in the IrDA dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service buffer underflow and application crash via a crafted packet...
UBUNTU-CVE-2013-7345
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service CPU consumption via a crafted ASCII file that triggers a large amount of...