SUSE-SU-2016:1820-1 Security update for apache2-mod_fcgid

This update for apache2-modfcgid fixes the following issues: It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-1000104. As a result, these server components...

UBUNTU-CVE-2016-5387

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2016-04612)

Apache HTTP Server is an open source web server from the Apache Software Foundation. Apache HTTP Server versions 2.4.17 and 2.4.18, with modhttp2 enabled, do not limit the number of simultaneous stream jobs for a single HTTP/2 connection. By modifying the stream control window, a remote attacker...

The vulnerability of the Apache HTTP Server’s software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The status of the competition in the modstatus module of the Apache HTTP Server allows malicious actors operating remotely to trigger service failures overflow of buffers in dynamic memory, gain access to confidential information, or execute arbitrary code through a specially crafted request. Thi...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability exists in the modcgid module of the Apache HTTP Server due to the absence of a timeout mechanism. Exploiting this vulnerability allows malicious actors to cause a service failure by sending requests to the CGI script, thereby ignoring the data from their own stdin descriptor...

Apache Subversion httpd Server Denial of Service Vulnerability

Apache Subversion is the United States Apache Apache Software Foundation of a set of open source version control system. The main role of the system is compatible with concurrent version management system CVS. httpd servers is one of the httpd server. A denial-of-service vulnerability exists in t...

[SECURITY] Fedora 24 Update: php-5.6.20-1.fc24

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

http-apache-server-status NSE Script

Attempts to retrieve the server-status page for Apache webservers that have modstatus enabled. If the server-status page exists and appears to be from modstatus the script will parse useful information such as the system uptime, Apache version and recent HTTP requests. References: Script Argument...

Default Apache Configuration Can Unmask Tor Hidden Services

Attention Tor Onion Hosters! A year old loophole in Apache Web Server, uncovered by an unknown Computer Science Student, could potentially unmask the real identity of .onion-domains and servers hidden behind the Tor-network. Although the loophole was reported on Reddit and to the Tor Project mont...

httpd: HTTP request smuggling attack against chunked request parser

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

httpd: bypass of mod_headers rules via chunked requests

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

Moderate: Red Hat Enhancement Advisory: Red Hat JBoss Web Server 3.0.1 enhancement update

Updated Red Hat JBoss Web Server 3.0.1 packages are now available for Red Hat Enterprise Linux 7. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apach...

Automated Evil Twin Attack: infernal-twin

Evil twin is a term for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. An evil twin is the wireless version of the phishing scam. An attacker fools wireless users into connecting a lapto...

httpd: HTTP request smuggling attack against chunked request parser

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP...

The vulnerability of the Apache HTTP Server web server allows attackers to trigger a service failure.

The vulnerability of the readrequestline function in the server/protocol.c component of the Apache HTTP Server is related to pointer arithmetic errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a specially crafted request...

Apache ap_some_auth_required() Security Bypass Vulnerability

Apache is an open source HTTPD service program. An unspecified security vulnerability exists in the Apache apsomeauthrequired function, where the Require directive is still used for authorization settings and displayed in the configuration because the program does not require authentication. A...

Apple MAC OS X Apache Server HTTP Authentication Bypass Vulnerability

Apple Mac OS X is a commercial operating system. Apple Mac OS X default Apache configuration does not contain the modhfsapple vulnerability, which allows remote attackers to exploit the vulnerability by submitting a special request to access HTTP authentication-protected directory information...