CVE-2014-0118: Uncontrolled Resource Consumption

The deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size...

CVE-2014-0118

The deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size...

CVE-2014-0226: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the modstatus module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service heap-based buffer overflow, or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard...

CVE-2014-0226

Race condition in the modstatus module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service heap-based buffer overflow, or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard...

CVE-2014-0117

The modproxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service child-process crash via a crafted HTTP Connection header...

CVE-2014-0231: Undefined Security Weakness

The modcgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service process hang via a request to a CGI script that does not read from its stdin file descriptor...

CVE-2014-0117: Improper Input Validation

The modproxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service child-process crash via a crafted HTTP Connection header...

Apache HTTP Server mod_proxy Denial Of Service Vulnerability

This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Apache HTTP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the modproxy module. The issue lies in the processing of HTTP headers...

Apache httpd mod_status Heap Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache HTTPD server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the updating of modstatus. A race condition in modstatus allows an attacker to...

PT-2014-1435

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.1 through 2.4.9 Description A memory leak in the winnt accept function in the WinNT MPM allows remote attackers to cause a denial of service via crafted requests, leading to memory consumption. This issue is...

PT-2014-1433

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 through 2.4.9 Description The issue allows remote attackers to cause a denial of service, resulting in the child process crashing when a specially crafted HTTP Connection header is sent to a server configured ...

apache24 -- several vulnerabilities

Apache HTTP SERVER PROJECT reports: modproxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM. Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow. moddeflate: The DEFLATE input filter...

PT-2014-1434

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description A race condition in the mod status module allows remote attackers to cause a denial of service, obtain sensitive credential information, or execute arbitrary code via a crafted request th...

PT-2014-1438

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 Description The issue is related to a function cache invalidate in the mod cache module. It allows remote HTTP servers to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereferenc...

PT-2014-1436

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description The issue allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size. This occurs when request body...

PT-2014-1437

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description The issue is related to the mod cgid module, which lacks a timeout mechanism. This allows remote attackers to cause a denial of service process hang by sending a request to a CGI script...

phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-8 CVE ID : CVE-2013-3239 CVE-2013-4995 CVE-2013-4996 CVE-2013-5003 Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:...

phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-8 CVE ID : CVE-2013-3239 CVE-2013-4995 CVE-2013-4996 CVE-2013-5003 Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:...

DLA-0014-1 phpmyadmin - security update

Bulletin has no description...

Important: mod_wsgi

Issue Overview: It was found that modwsgi did not properly drop privileges if the call to setuid failed. If modwsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system...