Directory traversal

moduserdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the nobody directory...

DEBIAN-CVE-2008-1270

moduserdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the nobody directory...

CVE-2008-1270

moduserdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the nobody directory...

CVE-2008-1270

moduserdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the nobody directory...

CVE-2008-1270

lighttpd

[SECURITY] [DSA 1513-1] New lighttpd packages fix CGI source disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1513-1 [email protected] http://www.debian.org/security/ Steve Kemp March 06, 2008 http://www.debian.org/security/faq -...

Debian DSA-1513-1 : lighttpd - information disclosure

It was discovered that lighttpd, a fast webserver with minimal memory footprint, would display the source to CGI scripts if their execution failed in some circumstances. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Fedora 8 : lighttpd-1.4.18-6.fc8 (2008-2278)

Tue Mar 4 2008 Matthias Saou 1.4.18-6 - Include patch for CVE-2008-0983 crash when low on file descriptors. - Include patch for CVE-2008-1111 cgi source disclosure. - Tue Feb 19 2008 Fedora Release Engineering - Autorebuild for GCC 4.3 - Wed Dec 5 2007 Release Engineering - Rebuild for deps - Wed...

Fedora 7 : lighttpd-1.4.18-3.fc7 (2008-2262)

Tue Mar 4 2008 Matthias Saou 1.4.18-3 - Include patch for CVE-2008-0983 crash when low on file descriptors. - Include patch for CVE-2008-1111 cgi source disclosure. - Tue Oct 16 2007 Matthias Saou 1.4.18-2 - Include modgeoip additional source, make it an optional sub-package. - Reorder...

Lighttpd mod_cgi模块信息泄露漏洞

BUGTRAQ ID: 28100 CVECAN ID: CVE-2008-1111 Lighttpd是一款轻型的开放源码Web Server软件包。 Lighttpd在处理意外情况时存在漏洞，远程攻击者可能利用此漏洞获取服务器上的源码。 当运行在Lighttpd上的modcgi无法再继续fork时（如达到ulimit），就会发送cgi脚本的完整源码，导致泄露敏感信息。 LightTPD LightTPD 1.4.18-r2 厂商补丁： Gentoo ------ Gentoo已经为此发布了一个安全公告（GLSA-200803-10）以及相应补丁:...

GLSA-200803-10 : lighttpd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-10 lighttpd: Multiple vulnerabilities lighttpd contains a calculation error when allocating the global file descriptor array CVE-2008-0983. Furthermore, it sends the source of a CGI script instead of returning a 500 error...

[SECURITY] [DSA 1513-1] New lighttpd packages fix CGI source disclosure

------------------------------------------------------------------------ Debian Security Advisory DSA-1513-1 [email protected] http://www.debian.org/security/ Steve Kemp March 06, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

[SECURITY] Fedora 8 Update: lighttpd-1.4.18-6.fc8

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

[SECURITY] Fedora 7 Update: lighttpd-1.4.18-3.fc7

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

DSA-1513-1 lighttpd - information disclosure

Bulletin has no description...

lighttpd: Multiple vulnerabilities

Background lighttpd is a lightweight high-performance web server. Description lighttpd contains a calculation error when allocating the global file descriptor array CVE-2008-0983. Furthermore, it sends the source of a CGI script instead of returning a 500 error Internal Server Error when the fork...

Lighttpd < 1.4.19 Information Disclosure

Binary data 4411.prm...

CVE-2008-1111

modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information...

CVE-2008-1111

modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information...

CVE-2008-1111

modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information...