EUVD-2011-4292

Malware in sbrugna...

MGASA-2022-0369 Updated lighttpd packages fix security vulnerability

In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request websocket handshake is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 A...

OPENSUSE-SU-2022:0024-1 Security update for lighttpd

This update for lighttpd fixes the following issues: lighttpd was updated to 1.4.64: CVE-2022-22707: off-by-one stack overflow in the modextforward plugin boo1194376 graceful restart/shutdown timeout changed from 0 disabled to 8 seconds. configure an alternative with: server.feature-flags +=...

OPENSUSE-SU-2019:2347-1 Security update for lighttpd

This update for lighttpd to version 1.4.54 fixes the following issues: Security issues fixed: - CVE-2018-19052: Fixed a path traversal in modalias boo1115016. - Changed the default TLS configuration of lighttpd for better security out-of-the-box boo1087369...

Updated lighttpd packages fix security vulnerabilities

Updated lighttpd package fixes security vulnerabilities: Potential path traversal with specific configs or in some use cases in modalias. use-after-free invalid Range requests in core. Process headers after combining folded headers in core. Skip username "." and ".." in moduserdir...

MGASA-2018-0430 Updated lighttpd packages fix security vulnerabilities

Updated lighttpd package fixes security vulnerabilities: Potential path traversal with specific configs or in some use cases in modalias. use-after-free invalid Range requests in core. Process headers after combining folded headers in core. Skip username "." and ".." in moduserdir...

SUSE-SU-2017:0728-1 Security update for lighttpd

This update for lighttpd fixes the following issues: Security issues fixed: - CVE-2016-1000212: don't allow requests to set the HTTPPROXY variable. As CGI apps might pick it up and use it for outgoing requests bsc990847. - CVE-2015-3200: log injection via malformed base64 string in Authentication...

SUSE-SU-2017:0731-1 Security update for lighttpd

This update for lighttpd fixes the following issues: Security issues fixed: - CVE-2016-1000212: Don't allow requests to set the HTTPPROXY variable. As CGI apps might pick it up and use it for outgoing requests. bsc990847 - CVE-2015-3200: Log injection via malformed base64 string in Authentication...

Updated lighttpd packages fix CVE-2015-3200 & other bugs

Updated lighttpd packages fix security vulnerability: modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character CVE-2015-3200. The...

CVE-2013-4508

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network...

[Full-Disclosure] [ GLSA 200502-21 ] lighttpd: Script source disclosure

Gentoo Linux Security Advisory GLSA 200502-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

lighttpd -- script source disclosure vulnerability

The lighttpd website reports: In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications. The vulnerability is in the handling of urlencoded trailing NUL bytes. Installations that do not use CGI or FastCGI are not affected...