CVE-2017-7679

CVE-2017-7679 affects Apache HTTP Server (httpd) mod_mime. A buffer over-read allows reading one byte past the end of a buffer when sending a malicious Content-Type header, potentially enabling a crash or memory access issues. Affected products include httpd 2.2.x before 2.2.33 and 2.4.x before 2...

CVE-2017-3167

CVE-2017-3167 affects Apache httpd 2.2.x prior to 2.2.33 and 2.4.x prior to 2.4.26. The issue is that third‑party modules using ap_get_basic_auth_pw() outside the authentication phase can bypass authentication requirements. Connected sources confirm the impact and upstream fixes: update to httpd ...

CVE-2017-7668

The Apache httpd server is vulnerable to a buffer over-read in the ap_find_token() function. This issue originated from HTTP strict parsing changes introduced in versions 2.2.32 and 2.4.24 . A remote attacker can exploit this by sending a maliciously crafted sequence of request headers, potential...

CVE-2017-3169

CVE-2017-3169 affects Apache HTTP Server (httpd) up to the fixed versions: 2.2.x before 2.2.33 and 2.4.x before 2.4.26. The vulnerability is a NULL pointer dereference in the httpd’s mod_ssl component when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS po...

CVE-2017-9798

The Apache HTTP Server is vulnerable to a use-after-free issue, commonly referred to as Optionsbleed , affecting versions through 2.2.34 and 2.4.27 . A remote, unauthenticated attacker can send a specially crafted OPTIONS HTTP request to read secret data from the process memory. This vulnerabilit...

CVE-2017-9788

Apache httpd versions prior to 2.2.34 and 2.4.x before 2.4.27 are vulnerable to a memory management flaw in the mod_auth_digest module. The value placeholder in [Proxy-]Authorization headers of type 'Digest ' is not properly initialized or reset between successive key=value assignments. An attack...

CVE-2016-8743

The CVE-2016-8743 issue affects Apache HTTP Server. It concerns how whitespace is accepted in requests and sent in response lines and headers in all releases before 2.2.32 and 2.4.25. The root problem is liberal whitespace handling, which can enable request smuggling, response splitting, and cach...

CVE-2016-0736

Apache HTTP Server versions 2.4.0 to 2.4.23 are vulnerable via the mod_session_crypto module. The component is susceptible to padding oracle attacks , particularly when using CBC mode of operation, because it lacks selectable or built-in authenticated encryption while encrypting data and cookies....

CVE-2016-2161

CVE-2016-2161 affects Apache HTTP Server 2.4.0–2.4.23 in the mod_auth_digest pathway. Malicious input to mod_auth_digest could cause the server to crash, and subsequent valid requests could still trigger crashes. The connected advisory pages confirm Apache’s fix to 2.4.25 (and related advisories)...

CVE-2017-7659

A NULL pointer dereference vulnerability in the mod_http2 module of Apache HTTP Server versions 2.4.24 and 2.4.25 can be triggered by a maliciously constructed HTTP/2 request . This flaw allows a remote attacker to cause the server process to crash, resulting in a denial of service. Impacted prod...

CVE-2017-9789

CVE-2017-9789 concerns Apache httpd 2.4.26. The HTTP/2 handling code may access memory after it has been freed when under stress (closing many connections), leading to erratic behavior. Connected advisories confirm the vulnerability is in mod_http2 and suggest upgrading to a fixed version (e.g., ...