CVE-2014-0118: Uncontrolled Resource Consumption

The deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size...

CVE-2014-0117: Improper Input Validation

The modproxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service child-process crash via a crafted HTTP Connection header...

CVE-2014-0231: Undefined Security Weakness

The modcgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service process hang via a request to a CGI script that does not read from its stdin file descriptor...

CVE-2013-4352: Undefined Security Weakness

The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service NULL pointer dereference and daemon crash via vectors that trigger a missing hostna...

CVE-2014-0117

The modproxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service child-process crash via a crafted HTTP Connection header...

Apache HTTP Server mod_proxy Denial Of Service Vulnerability

This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Apache HTTP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the modproxy module. The issue lies in the processing of HTTP headers...

Apache httpd mod_status Heap Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache HTTPD server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the updating of modstatus. A race condition in modstatus allows an attacker to...

apache24 -- several vulnerabilities

Apache HTTP SERVER PROJECT reports: modproxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM. Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow. moddeflate: The DEFLATE input filter...

PT-2014-1433

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 through 2.4.9 Description The issue allows remote attackers to cause a denial of service, resulting in the child process crashing when a specially crafted HTTP Connection header is sent to a server configured ...

PT-2014-1435

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.1 through 2.4.9 Description A memory leak in the winnt accept function in the WinNT MPM allows remote attackers to cause a denial of service via crafted requests, leading to memory consumption. This issue is...

PT-2014-1438

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 Description The issue is related to a function cache invalidate in the mod cache module. It allows remote HTTP servers to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereferenc...

PT-2014-1436

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description The issue allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size. This occurs when request body...

PT-2014-1434

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description A race condition in the mod status module allows remote attackers to cause a denial of service, obtain sensitive credential information, or execute arbitrary code via a crafted request th...

PT-2014-1437

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.10 Description The issue is related to the mod cgid module, which lacks a timeout mechanism. This allows remote attackers to cause a denial of service process hang by sending a request to a CGI script...

phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-8 CVE ID : CVE-2013-3239 CVE-2013-4995 CVE-2013-4996 CVE-2013-5003 Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:...

phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-8 CVE ID : CVE-2013-3239 CVE-2013-4995 CVE-2013-4996 CVE-2013-5003 Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems:...

DLA-0014-1 phpmyadmin - security update

Bulletin has no description...

Important: mod_wsgi

Issue Overview: It was found that modwsgi did not properly drop privileges if the call to setuid failed. If modwsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system...

Type confusion

The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHPAUTHPW, PHPAUTHTYPE, PHPAUTHUSER, and PHPSELF variables, which might allow context-dependent attackers to obtain sensitive information from process...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update

Updated tomcat7 packages that fix three security issues are now available for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, whic...