Lighttpd <= 1.4.15 Multiple Code Execution, Denial of Service and Information Disclosure Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/24967/info Lighttpd is prone to multiple remote denial-of-service vulnerabilities, a code-execution vulnerability, and an information-disclosure vulnerability. An attacker can exploit these issues to execute arbitrary cod...

lighttpd 1.4/1.5 Slow Request Handling Remote Denial Of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38036/info The 'lighttpd' webserver is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to hang, denying service to legitimate users. slowtest.sh for j=0;j1000;j...

Lighttpd <= 1.4.17 FastCGI Header Overflow Remote Exploit

No description provided by source. / hoagielighttpd.c LIGHTTPD/FASTCGI REMOTE EXPLOIT = 1.4.17 Bug discovered by: Mattias Bengtsson [email protected] Philip Olausson [email protected] http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ FastCGI:...

Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit

No description provided by source. / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a remove me in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer=?php system'/usr/bin/id'; ? localhost ./exploit localhost 80...

lighttpd 1.4.31 Denial of Service PoC

No description provided by source. !/bin/bash Exploit Title: simple lighttpd 1.4.31 DOS POC Date: 11/21/2012 Exploit Author: [email protected] Vendor Homepage: http://www.lighttpd.net Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz Version: 1.4.31 Tested on:...

Lighttpd 1.4.x - mod_userdir Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28226/info The 'lighttpd' program is prone to a vulnerability that may allow attackers to access sensitive information because the application fails to properly handle exceptional conditions. Information obtained may aid ...

Lighttpd < 1.4.23 Source Code Disclosure Vulnerability (BSD/Solaris bug)

No description provided by source. Severe vulnerability due to a bug in FreeBSD, OS X and Solaris 10 filesystems affecting Lighttpd 1.4.23 A bug was discovered in the way FreeBSD, OS X and Solaris prior version 10 handle symlinks appended with a slash /. Accessing a regular file through a symboli...

GLSA-201406-10 : lighttpd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-10 lighttpd: Multiple vulnerabilities Multiple vulnerabilities have been discovered in lighttpd. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could create a Denial of Service...

openSUSE Security Update : lighttpd (openSUSE-2012-110)

added lighttpd-1.4.30headfixes.patch: cherry picked 4 fixes from HEAD : - ssl include more headers explicitly - list all network handlers in lighttpd -V fixes lighttpd2376 - Move fdevent subsystem includes to implementation files to reduce conflicts fixes lighttpd2373 - ssl fix segfault in...

openSUSE Security Update : lighttpd (openSUSE-SU-2012:0240-1)

This update of lighttpd fixes an out-of-bounds read due to a signedness error which could cause a Denial of Service CVE-2011-4362. Additionally an option was added to honor the server cipher order resolves lighttpd2364. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : lighttpd (openSUSE-SU-2014:0449-1)

lighttpd was updated to version 1.4.35, fixing bugs and security issues : CVE-2014-2323: SQL injection vulnerability in modmysqlvhost.c in lighttpd allowed remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname. CVE-2014-2323: Multiple directory...

lighttpd: Multiple vulnerabilities

Background lighttpd is a lightweight high-performance web server. Description Multiple vulnerabilities have been discovered in lighttpd. Please review the CVE identifiers referenced below for details. Impact A remote attacker could create a Denial of Service condition. Futhermore, a remote attack...

openSUSE Security Update : lighttpd (openSUSE-SU-2014:0072-1)

added cve-2013-4508.patch and cve-2013-4508-regression-bug729480.patch: bnc849059 When defining an ssl.cipher-list, it works for the 'default' HTTPS setup $SERVER'socket' 443 block, but when you utilize SNI $HTTP'host' blocks within the $SERVER'socket' block the ssl.cipher-list seems to not...

openSUSE Security Update : lighttpd (openSUSE-SU-2012:1532-1)

Fixing bnc790258 CVE-2012-5533: Denial of Service via specially crafted HTTP header. Added patches: 0001-Fix-DoS-in-header-value-split-reported-by-Jesse-Sip p.patch 0001-remove-whitespace-at-end-of-header-keys.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Medium: lighttpd

Issue Overview: Multiple directory traversal vulnerabilities in 1 modevhost and 2 modsimplevhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. dot dot in the host name, related to requestcheckhostname. SQL injection vulnerability in modmysqlvhost.c in lighttpd...

Lighttpd < 1.4.35 Multiple Vulnerabilities - Active Check

Lighttpd is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lighttpd:lighttpd"; ifdescription...

CVE-2014-2469

Unspecified vulnerability in lighttpd in Oracle Solaris 11.1 allows attackers to cause a denial of service via unknown vectors...

CVE-2014-2469

Affected software: Oracle Solaris 11.1 with lighttpd. Vulnerable component: lighttpd service (unspecified vulnerability) leading to denial of service via unknown vectors. Documented impact: denial of service; CVSS v2 base score 5.0 (MEDIUM) per NVD. Root cause details are not provided in the sour...

SuSE Update for lighttpd openSUSE-SU-2014:0496-1 (lighttpd)

Check for the Version of lighttpd OpenVAS Vulnerability Test $Id: gbsuse201404961.nasl 8044 2017-12-08 08:32:49Z santu $ SuSE Update for lighttpd openSUSE-SU-2014:0496-1 lighttpd Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This...

openSUSE: Security Advisory for lighttpd (openSUSE-SU-2014:0496-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...