CVE-2013-1427

CVE-2013-1427 affects lighttpd before 1.4.28 on Debian GNU/Linux. The FastCGI PHP support configuration creates a socket file in /tmp with a predictable name, enabling local users to hijack the PHP control socket and perform unauthorized actions such as forcing a different PHP version via a symli...

CVE-2013-1427

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

lighttpd不安全临时文件创建漏洞(CVE-2013-1427)

BUGTRAQ ID: 58528 CVECAN ID: CVE-2013-1427 Lighttpd是一款轻型的开放源码Web Server软件包。 lighttpd在实现上存在不安全的临时文件创建漏洞，本地攻击者可利用此漏洞在受影响应用中执行符号链接攻击，覆盖任意文件。 0 Lighttpd 厂商补丁： Debian ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.debian.org/security/...

[SECURITY] [DSA 2649-1] lighttpd security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2649-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

Debian DSA-2649-1 : lighttpd - fixed socket name in world-writable directory

Stefan Buhler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP contr...

[SECURITY] [DSA 2649-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2649-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

DSA-2649-1 lighttpd - fixed socket name in world-writable directory

Bulletin has no description...

Debian Security Advisory DSA 2649-1 (lighttpd - fixed socket name in world-writable directory)

Stefan Bühler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP contr...

Debian: Security Advisory (DSA-2649-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2626-1 : lighttpd - several issues

Several vulnerabilities were discovered in the TLS/SSL protocol. This update addresses these protocol vulnerabilities in lighttpd. - CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered that the TLS and SSLv3 protocols do not properly associate renegotiation handshakes with an...

[SECURITY] [DSA 2626-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2626-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst February 17, 2013 http://www.debian.org/security/faq -...

DSA-2626-1 lighttpd - several issues

Bulletin has no description...

Debian Security Advisory DSA 2626-1 (lighttpd - several issues)

Several vulnerabilities were discovered in the TLS/SSL protocol. This update addresses these protocol vulnerabilities in lighttpd. CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered that the TLS and SSLv3 protocols do not properly associate renegotiation handshakes with an existin...

Debian: Security Advisory (DSA-2626-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

lighttpd Connection Header Parsing Denial of Service (CVE-2012-5533)

A denial-of-service vulnerability has been reported in lighttpd...

lighttpd 1.4.31 http_request_split_value Function Header Handling DoS

According to its banner, the version of lighttpd running on the remote host is 1.4.31. It is, therefore, affected by a denial of service vulnerability. An error in the httprequestsplitvalue function in 'src/request.c' can cause the application to enter an endless loop when handling specially...

FreeBSD Ports: lighttpd

The remote host is missing an update to the system as announced in the referenced advisory. VID 1cd3ca42-33e6-11e2-a255-5404a67eef98 OpenVAS Vulnerability Test $ Description: Auto generated from VID 1cd3ca42-33e6-11e2-a255-5404a67eef98 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

FreeBSD Ports: lighttpd

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

DEBIAN-CVE-2012-5533

The httprequestsplitvalue function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service infinite loop via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header...

CVE-2012-5533

The httprequestsplitvalue function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service infinite loop via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header...