apr: DoS flaw in apr_fnmatch() due to fix for CVE-2011-0419

The fnmatch implementation in aprfnmatch.c in the Apache Portable Runtime APR library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service infinite loop via a URI that does not match unspecified types of wildcard patterns, as demonstrated by...

Low: Red Hat Security Advisory: apr security update

Updated apr packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : apr/apr-util (SSA:2011-145-01)

New apr and apr-util packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue in apr and a crash bug in apr-util. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

[slackware-security] apr/apr-util

New apr and apr-util packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue in apr and a crash bug in apr-util. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/apr-1.4.5-i486-1slack13.37.txz: Upgraded. This...

CVE-2011-1928

The fnmatch implementation in aprfnmatch.c in the Apache Portable Runtime APR library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service infinite loop via a URI that does not match unspecified types of wildcard patterns, as demonstrated by...

CVE-2011-1928

The CVE-2011-1928 issue affects the APR library’s fnmatch implementation (apr_fnmatch.c) in APR 1.4.3/1.4.4 and Apache HTTP Server 2.2.18, causing an infinite-loop DoS when processing certain URIs due to an incorrect fix for CVE-2011-0419. Connected advisories note the problem is triggered by wil...

USN-1134-1: APR vulnerabilities

Maksymilian Arciemowicz reported that a flaw in the fnmatch implementation in the Apache Portable Runtime APR library could allow an attacker to cause a denial of service. This can be demonstrated in a remote denial of service attack against modautoindex in the Apache web server. CVE-2011-0419 Is...

FreeBSD : Apache APR -- DoS vulnerabilities (99a5590c-857e-11e0-96b7-00300582f9fc)

The Apache Portable Runtime Project reports : A flaw was discovered in the aprfnmatch function in the Apache Portable Runtime APR library 1.4.4 or any backported versions that contained the upstream fix for CVE-2011-0419. This could cause httpd workers to enter a hung state 100% CPU utilization...

Mandriva Linux Security Advisory : apr (MDVSA-2011:095-1)

It was discovered that the fix for CVE-2011-0419 under certain conditions could cause a denial-of-service DoS attack in APR CVE-2011-1928. Packages for 2010.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:...

Mandriva Update for apr MDVSA-2011:095 (apr)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] [DSA 2237-2] apr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2237-2 [email protected] http://www.debian.org/security/ Stefan Fritsch May 21, 2011 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2237-2] apr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2237-2 [email protected] http://www.debian.org/security/ Stefan Fritsch May 21, 2011 http://www.debian.org/security/faq -...

[ MDVSA-2011:095 ] apr

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:095 http://www.mandriva.com/security/ Package : apr Date : May 20, 2011 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 Problem Description: It was discovered that the fix for CVE-2011-0419...

Apache APR -- DoS vulnerabilities

The Apache Portable Runtime Project reports: A flaw was discovered in the aprfnmatch function in the Apache Portable Runtime APR library 1.4.4 or any backported versions that contained the upstream fix for CVE-2011-0419. This could cause httpd workers to enter a hung state 100% CPU utilization...

RedHat Update for apr RHSA-2011:0507-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Update for apr MDVSA-2011:084 (apr)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-0419

CVE-2011-0419 is a stack consumption/DoS vulnerability in the APR library’s fnmatch implementation (apr_fnmatch.c) and, for some platforms, in libc’s fnmatch.c. It affects APR < 1.4.3 and Apache HTTP Server

[SECURITY] [DSA 2237-1] apr security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2237-1 [email protected] http://www.debian.org/security/ Stefan Fritsch May 15, 2011 http://www.debian.org/security/faq -...

FreeBSD : Apache APR -- DoS vulnerabilities (00b296b6-7db1-11e0-96b7-00300582f9fc)

The Apache Portable Runtime Project reports : Note especially a security fix to APR 1.4.4, excessive CPU consumption was possible due to an unconstrained, recursive invocation of aprfnmatch, as aprfnmatch processed '' wildcards. Reimplement aprfnmatch from scratch using a non-recursive algorithm...

Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : apr/apr-util (SSA:2011-133-01)

New apr and apr-util packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory...