CVE-2016-4979: Improper Access Control

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-1546: Undefined Security Weakness

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

Apache HTTP Server Information Disclosure

A vulnerability exists in the cacheinvalidate function in the modules/cache/cachestorage.c module of the modcache module in the Apache HTTP Server. When the caching proxy server is enabled, this vulnerability allows remote HTTP servers to cause a service failure by reassigning the null pointer an...

Apache HTTP Server Information Disclosure

A memory leak in the winntaccept function in server/mpm/winnt/child.c, within WinNT MPM in the Apache HTTP Server, when the standard AcceptFilter is enabled, allows malicious actors operating remotely to trigger a denial-of-service attack by using specially crafted requests...

PT-2016-6205

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.18 through 2.4.20 Description The issue allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation,...

[SECURITY] Fedora 24 Update: php-5.6.23-1.fc24

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Apache Continuum Arbitrary Command Execution

A remote command injection vulnerability exists in Apache HTTP servers. By exploiting this vulnerability, a remote attacker can execute arbitrary code on the affected server...

[slackware-security] php

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/php-5.6.23-i486-1slack14.1.txz: Upgraded. This release fixes bugs and security issues. For more information, see:...

SOL12254802 - Apache httpd HTTP/2 vulnerability CVE-2016-1546

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

[SECURITY] Fedora 22 Update: php-5.6.22-1.fc22

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Open-Xchange: Outdated Apache Server in www.dovecot.fi is vulnerable to various attack.

Apache HTTP Server NULL Pointer Dereference Vulnerability CVE 2014-3581. Apache HTTP Server 2.4.10 and earlier is prone to a vulnerability, which can be exploited to cause a DoS Denial of Service. The vulnerability exists because the application contains flaw in the cachemergeheadersout function...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

[SECURITY] Fedora 23 Update: php-5.6.20-1.fc23

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 22 Update: php-5.6.20-1.fc22

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Moderate: Red Hat Security Advisory: rh-php56-php security update

Updated rh-php56-php packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

[SECURITY] Fedora 22 Update: php-5.6.19-1.fc22

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 23 Update: php-5.6.19-1.fc23

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 22 Update: php-5.6.18-1.fc22

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Apache Httpd < 2.2.32 : Apache HTTP Request Parsing Whitespace Defects

Apache HTTP Server, prior to release 2.4.25 and 2.2.32, accepted a broad pattern of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB in parsing the request line and request header lines, as well as HTAB in parsing the request line. Any bare CR present in request lines...