Fedora 13 : apr-util-1.3.10-1.fc13 (2010-15953)

This update includes the latest stable release of the APR-util library. A memory leak in the aprbrigadesplitline function allowed a denial of service attack network services using this function, such as the Apache HTTP Server. CVE-2010-1623 Bug fixes to the 'thread pool' interfaces and ODBC suppo...

[SECURITY] Fedora 14 Update: nss-util-3.12.8-1.fc14

Utilities for Network Security Services and the Softoken module...

Fedora 13 : nss-3.12.8-2.fc13 / nss-softokn-3.12.8-1.fc13 / nss-util-3.12.8-1.fc13 (2010-15520)

Update to 3.12.8 Improves handling of certificates with IP wildcards: http://www.mozilla.org/security/announce/2010/mfsa2010-70.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Apache 2.2.x < 2.2.17 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.17. It is, therefore, affected by the following vulnerabilities : - Errors exist in the bundled expat library that may allow an attacker to crash the server when a buffer is over- read when parsing an...

Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability

Apache APR-Util is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandriva Linux Security Advisory : apr-util (MDVSA-2010:192)

A denial of service attack against aprbrigadesplitline was discovered in apr-util CVE-2010-1623. Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/productinfo.php?cPath=149&productsid=4 90 The update...

Debian DSA-2117-1 : apr-util - denial of service

APR-util is part of the Apache Portable Runtime library which is used by projects such as Apache httpd and Subversion. Jeff Trawick discovered a flaw in the aprbrigadesplitline function in apr-util. A remote attacker could send crafted http requests to cause a greatly increased memory consumption...

FreeBSD : apr -- multiple vunerabilities (dd943fbb-d0fe-11df-95a8-00219b0fc4d8)

Secunia reports : Multiple vulnerabilities have been reported in APR-util, which can be exploited by malicious people to cause a DoS Denial of Service. Two XML parsing vulnerabilities exist in the bundled version of expat. An error within the 'aprbrigadesplitline' function in buckets/aprbrigade.c...

[SECURITY] [DSA-2117-1] New apr-util packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-2117-1 [email protected] http://www.debian.org/security/ Stefan Fritsch October 4, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-2117-1] New apr-util packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-2117-1 [email protected] http://www.debian.org/security/ Stefan Fritsch October 4, 2010 http://www.debian.org/security/faq -...

CVE-2010-1623

The CVE-2010-1623 issue affects the APR-util library (apr_brigade_split_line in buckets/apr_brigade.c) prior to version 1.3.10, where a memory leak can allow remote attackers to cause denial of service through memory consumption related to APR bucket destruction. Affected products commonly includ...

CVE-2010-1623

Memory leak in the aprbrigadesplitline function in buckets/aprbrigade.c in the Apache Portable Runtime Utility library aka APR-util before 1.3.10, as used in the modreqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service memory...

Mandriva Update for apr-util MDVSA-2010:192 (apr-util)

Check for the Version of apr-util OpenVAS Vulnerability Test Mandriva Update for apr-util MDVSA-2010:192 apr-util Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for apr-util MDVSA-2010:192 (apr-util)

Check for the Version of apr-util OpenVAS Vulnerability Test Mandriva Update for apr-util MDVSA-2010:192 apr-util Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

DSA-2117-1 apr-util - denial of service

Bulletin has no description...

apr -- multiple vunerabilities

Secunia reports: Multiple vulnerabilities have been reported in APR-util, which can be exploited by malicious people to cause a DoS Denial of Service. Two XML parsing vulnerabilities exist in the bundled version of expat. An error within the "aprbrigadesplitline" function in buckets/aprbrigade.c...

apr-util billion laughs attack

The expat XML parser in the aprxml interface in xml/aprxml.c in Apache APR-util before 1.3.7, as used in the moddav and moddavsvn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service memory consumption via a crafted XML document containing a large number of nest...

apr-util heap buffer underwrite

The aprstrmatchprecompile function in strmatch/aprstrmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service daemon crash via crafted input involving 1 a .htaccess file used with the Apache HTTP Server, 2 the SVNMasterURI directive in the moddavsvn module in t...

horde-base -- XSS and CSRF vulnerabilities

The Horde team reports: Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability. Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface The major changes compared to Horde version 3.3.8 are: Fixed XSS vulnerability in...

Apache Httpd < 2.2.17 : apr_bridage_split_line DoS

A flaw was found in the aprbrigadesplitline function of the bundled APR-util library, used to process non-SSL requests. A remote attacker could send requests, carefully crafting the timing of individual bytes, which would slowly consume memory, potentially leading to a denial of service...