Apache HTTP Server 2.4.x < 2.4.23 Multiple Vulnerabilities

Binary data 9394.prm...

[SECURITY] Fedora 24 Update: httpd-2.4.23-3.fc24

The Apache HTTP Server is a powerful, efficient, and extensible web server...

Apache HTTP Server Denial of Service Vulnerability (Jul 2016)

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

DEBIAN-CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

Authorization

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-1546

The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service stream-processing outage via modified flow-control windows...

EUVD-2016-5947

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple...

CVE-2016-4979

CVE-2016-4979 affects Apache HTTP Server 2.4.18–2.4.20 when mod_http2 and mod_ssl are enabled; it fails to recognize the SSLVerifyClient require directive for HTTP/2 request authorization, enabling bypass of access restrictions by abusing multiple requests on a single connection and renegotiation...

Apache HTTPD Information Disclosure Vulnerability

Apache HTTP Server is an open source web server from the Apache Software Foundation. Apache HTTPD Web Server 2.4.18-2.4.20 fails to properly validate X509 client certificates for resource access over HTTP/2. This could allow third parties to access web server resources without credentials, leadin...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

A memory leak in the winntaccept function in server/mpm/winnt/child.c, within WinNT MPM in the Apache HTTP Server, when the standard AcceptFilter is enabled, allows malicious actors operating remotely to trigger a denial-of-service attack by using specially crafted requests...

Apache HTTP Server 'mod_negotiation' MultiViews Information Disclosure Vulnerability

Apache HTTP Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE =...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

A vulnerability exists in the cacheinvalidate function in the modules/cache/cachestorage.c module of the modcache module in the Apache HTTP Server. When the caching proxy server is enabled, this vulnerability allows remote HTTP servers to cause a service failure by reassigning the null pointer an...

[SECURITY] Fedora 24 Update: php-5.6.23-1.fc24

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Apache Continuum Arbitrary Command Execution

A remote command injection vulnerability exists in Apache HTTP servers. By exploiting this vulnerability, a remote attacker can execute arbitrary code on the affected server...