CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

CVE-2007-3948

connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...

CVE-2007-3948

connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...

CVE-2007-3950

CVE-2007-3950 affects lighttpd 1.4.15 on 32‑bit platforms. The issue is caused by incompatible format specifiers in debugging messages within the modules (mod_scgi, mod_fastcgi, mod_webdav), allowing remote attackers to cause a denial of service (daemon crash). The connected documents indicate th...

CVE-2007-3948

Vulnerability (CVE-2007-3948) in lighttpd prior to 1.4.16: the code path in connections.c may accept more connections than the configured maximum, enabling remote attackers to cause a denial of service via a flood of connection attempts (failed assertion). Affected product/version: lighttpd befor...

CVE-2007-3949

CVE-2007-3949 affects lighttpd’s mod_access.c. In lighttpd 1.4.15, trailing slash handling in URLs is ignored, enabling bypass of url.access-deny settings. Multiple sources link this with lighttpd versions prior to 1.4.16; remediation cited is to upgrade to 1.4.16 or later. Exploitation details a...

CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3950

lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the 1 modscgi, 2 modfastcgi, and 3 modwebdav modules...

CVE-2007-3947

CVE-2007-3947 : In lighttpd, the vulnerability arises from improper handling of repeated HTTP headers in requests, enabling remote attackers to crash the daemon via a crafted request containing two Location headers. Affected version cited: lighttpd 1.4.15. Impact is a denial of service (daemon cr...

CVE-2007-3947

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...

CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3946

lighttpd prior to 1.4.16 is affected by CVE-2007-3946 where mod_auth can be abused to crash the daemon via multiple vectors: (1) memory leak, (2) use of md5-sess without a cnonce, (3) base64-encoded strings, and (4) trailing whitespace in the Auth-Digest header. The issue is triggered in the http...

CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

lighttpd -- multiple vulnerabilities

Secunia Advisory reports: Some vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS Denial of Service...

Debian DSA-1303-1 : lighttpd - denial of service

Two problems were discovered with lighttpd, a fast webserver with minimal memory footprint, which could allow denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1869 Remote attackers could cause denial of service by disconnecting...

[SECURITY] [DSA 1303-1] New lighttpd packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1303-1 [email protected] http://www.debian.org/security/ Steve Kemp June 10, 2007 http://www.debian.org/security/faq -...

DSA-1303-1 lighttpd - denial of service

Bulletin has no description...

GLSA-200705-07 : Lighttpd: Two Denials of Service

The remote host is affected by the vulnerability described in GLSA-200705-07 Lighttpd: Two Denials of Service Robert Jakabosky discovered an infinite loop triggered by a connection abort when Lighttpd processes carriage return and line feed sequences. Marcus Rueckert discovered a NULL pointer...

Lighttpd: Two Denials of Service

Background Lighttpd is a lightweight HTTP web server. Description Robert Jakabosky discovered an infinite loop triggered by a connection abort when Lighttpd processes carriage return and line feed sequences. Marcus Rueckert discovered a NULL pointer dereference when a server running Lighttpd trie...

FreeBSD : lighttpd -- Remote DOS in CRLF parsing (d2b48d30-ea97-11db-a802-000fea2763ce)

Lighttpd SA : If the connection aborts during parsing '\r\n\r\n' the server might get into a infinite loop and use 100% of the CPU time. lighttpd still responses to other requests. This can be repeated until either the server limit for concurrent connections or file descriptors is reached. The bu...