DEBIAN-CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

DEBIAN-CVE-2007-3950

lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the 1 modscgi, 2 modfastcgi, and 3 modwebdav modules...

DEBIAN-CVE-2007-3947

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...

DEBIAN-CVE-2007-3948

connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...

DEBIAN-CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3947

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...

CVE-2007-3949

CVE-2007-3949 affects lighttpd’s mod_access.c. In lighttpd 1.4.15, trailing slash handling in URLs is ignored, enabling bypass of url.access-deny settings. Multiple sources link this with lighttpd versions prior to 1.4.16; remediation cited is to upgrade to 1.4.16 or later. Exploitation details a...

CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3950: Undefined Security Weakness

lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the 1 modscgi, 2 modfastcgi, and 3 modwebdav modules...

CVE-2007-3947

CVE-2007-3947 : In lighttpd, the vulnerability arises from improper handling of repeated HTTP headers in requests, enabling remote attackers to crash the daemon via a crafted request containing two Location headers. Affected version cited: lighttpd 1.4.15. Impact is a denial of service (daemon cr...

CVE-2007-3950

CVE-2007-3950 affects lighttpd 1.4.15 on 32‑bit platforms. The issue is caused by incompatible format specifiers in debugging messages within the modules (mod_scgi, mod_fastcgi, mod_webdav), allowing remote attackers to cause a denial of service (daemon crash). The connected documents indicate th...

CVE-2007-3948

connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...

CVE-2007-3946

lighttpd prior to 1.4.16 is affected by CVE-2007-3946 where mod_auth can be abused to crash the daemon via multiple vectors: (1) memory leak, (2) use of md5-sess without a cnonce, (3) base64-encoded strings, and (4) trailing whitespace in the Auth-Digest header. The issue is triggered in the http...

CVE-2007-3948

Vulnerability (CVE-2007-3948) in lighttpd prior to 1.4.16: the code path in connections.c may accept more connections than the configured maximum, enabling remote attackers to cause a denial of service via a flood of connection attempts (failed assertion). Affected product/version: lighttpd befor...

CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

CVE-2007-3947

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...

CVE-2007-3947: Undefined Security Weakness

request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...

CVE-2007-3949: Undefined Security Weakness

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...

CVE-2007-3949

modaccess.c in lighttpd 1.4.15 ignores trailing / slash characters in the URL, which allows remote attackers to bypass url.access-deny settings...