CVE-2018-25103

There are concrete technical details: CVE-2018-25103 affects lighttpd ≤ 1.4.50 where a use-after-free in request parsing may read memory pointers from the same request, potentially enabling a remote unauthenticated attacker to crash or leak memory. The issue was fixed in lighttpd 1.4.51 (August 2...

CVE-2018-25103

There exists use-after-free vulnerabilities in lighttpd = 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests...

lighttpd Security Vulnerabilities

lighttpd is an open source web server from the individual developer Jan Kneschke in Germany. A security vulnerability exists in lighttpd version 1.4.50 and earlier versions, which stems from memory reuse after release...

PT-2024-10621 · Lighttpd · Lighttpd

Name of the Vulnerable Software and Affected Versions: lighttpd versions = 1.4.50 Description: The issue is related to a use-after-free vulnerability that can allow access to compare data in a case-insensitive manner with a reused pointer. This vulnerability might read from invalid pointers to...

OPENSUSE-SU-2024:12382-1 lighttpd-1.4.67-2.1 on GA media

These are all security issues fixed in the lighttpd-1.4.67-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12327-1 lighttpd-1.4.66-1.1 on GA media

These are all security issues fixed in the lighttpd-1.4.66-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11764-1 lighttpd-1.4.64-1.1 on GA media

These are all security issues fixed in the lighttpd-1.4.64-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10402-1 lighttpd-1.4.37-1.6 on GA media

These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10585-1 lighttpd-1.4.59-2.1 on GA media

These are all security issues fixed in the lighttpd-1.4.59-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13390-1 lighttpd-1.4.73-1.1 on GA media

These are all security issues fixed in the lighttpd-1.4.73-1.1 package on the GA media of openSUSE Tumbleweed...

(0Day) D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made t...

CVE-2024-5293

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability. The...

CVE-2024-5294

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5293

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability. The...

CVE-2024-5294 D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5294

The CVE-2024-5294 entry concerns the D-Link DIR-3040 router. The vulnerable component is prog.cgi (HNAP handler for the lighttpd server on ports 80/443). The root cause is improper memory management when processing HTTP cookie values, causing a memory leak that enables a denial-of-service conditi...

CVE-2024-5294 D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability...

CVE-2024-5293

CVE-2024-5293 affects the D-Link DIR-2640-US router. The vulnerability resides in the prog.cgi handling HNAP requests to the lighttpd webserver (ports 80/443), where the length of user-supplied data is not properly validated before copying to a fixed-size stack-based buffer. This causes a stack-b...

CVE-2024-3708

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-3708

A condition exists in lighttpd version prior to 1.4.51 whereby a remote attacker can craft an http request which could result in multiple outcomes: 1. cause lighttpd to access freed memory in which case the process lighttpd is running in could be terminated or other non-deterministic behavior cou...