182.48.53.38
{
"scan_id": 1766556008,
"ip": "182.48.53.38",
"is_ipv4": true,
"is_ipv6": false,
"location": {
"network": "182.48.0.0/18",
"postal_code": "",
"coordinates": {
"latitude": "35.69",
"longitude": "139.69"
},
"geo_point": "35.69, 139.69",
"locale_code": "en",
"continent": "Asia",
"country_code": "JP",
"country_name": "Japan",
"city": ""
},
"location_updated_at": "2025-12-24T00:43:22Z",
"asn": {
"number": "AS9371",
"organization": "SAKURA Internet Inc.",
"country_code": ""
},
"asn_updated_at": "0001-01-01T00:00:00Z",
"whois": {
"network": "182.48.0.0/18",
"organization": "SAKURA Internet Inc.",
"descr": "SAKURA Internet Inc.",
"_encoding": {
"raw": "BASE64"
}
},
"whois_updated_at": "2024-12-10T12:44:28Z",
"tags": [
{
"name": "is_anonymous_proxy",
"pretty_name": "Anonymous Proxy",
"value": false,
"last_updated_at": "2025-12-24T00:43:22Z"
},
{
"name": "is_cdn",
"pretty_name": "CDN",
"value": false,
"last_updated_at": "2025-12-24T05:31:05Z"
},
{
"name": "is_satellite_provider",
"pretty_name": "Satellite Provider",
"value": false,
"last_updated_at": "2025-12-24T00:43:22Z"
}
],
"hostnames": [
{
"name": "www14244u.sakura.ne.jp",
"last_updated_at": "2025-12-24T05:31:05Z"
}
],
"services": [
{
"port": 25,
"protocol": "tcp",
"name": "smtp",
"version": "",
"product": "qmail smtpd",
"extra_info": "",
"tunnel": "",
"softwares": [
{
"uri": "cpe:/a:djb:qmail",
"part": "a",
"vendor": "djb",
"product": "qmail",
"version": "ANY",
"language": "ANY",
"edition": "ANY",
"update": "ANY"
}
],
"modules": {
"smtp": {
"banner": "220 s.irako.net ESMTP\r\n"
}
},
"_meta": {
"name": "",
"desc": "",
"category": ""
},
"last_updated_at": "2025-12-22T05:02:59.205Z"
},
{
"port": 80,
"protocol": "tcp",
"name": "http",
"version": "",
"product": "Apache httpd",
"extra_info": "",
"tunnel": "",
"softwares": [
{
"uri": "cpe:/a:apache:http_server",
"part": "a",
"vendor": "apache",
"product": "http_server",
"version": "ANY",
"language": "ANY",
"edition": "ANY",
"update": "ANY"
}
],
"modules": {
"http": {
"body": "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"ja\" xml:lang=\"ja\">\n<head>\n<title>irako.net</title>\n<style type=\"text/css\">\n<!--\nDIV{\n font-size : 12px;\n}\n\n.line1{\n background-color : #000000;\n width : 50px;\n height : 1px;\n}\n.line2{\n border-left: 1px solid #000000;\n}\n.title{\n font-size : 12px;\n font-weight: bold;\n padding : 0 0 0 0;\n border-left : 5px #000000;\n}\nA{\n color : #6666FF;\n text-decoration : none;\n}\nA:HOVER{\n color : #6666FF;\n text-decoration : underline;\n}\n.menu{\n padding : 2px 10px 2px 10px;\n border : 1px solid #000000;\n width : 150px;\n font-size : 12px;\n}\n-->\n</style>\n</head>\n\n\n<body>\n\n<table border=\"0\" cellpadding=\"0\" cellspacing=\"0\" width=\"400\" height=\"300\">\n\n<tr>\n<td width=\"200\">\n\n<table border=\"0\" width=\"200\" cellpadding=\"0\" cellspacing=\"0\">\n<tr>\n<td rowspan=\"3\" nowrap align=\"center\" class=\"title\">irako.net</td>\n<td><br /></td>\n</tr>\n<tr>\n<td bgcolor=\"#000000\" height=\"1\" width=\"80\"></td>\n</tr>\n<tr>\n<td><br /></td>\n</tr>\n</table>\n\n</td>\n\n<td width=\"200\">\n\n<table border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n\n<tr>\n<td></td>\n<td><br /></td>\n<td rowspan=\"3\">\n<div class=\"menu\"><!a href=\"http://blog.irako.net/\">Irako::Blog</A></div>\n</td>\n</tr>\n<tr>\n<td rowspan=\"10\" width=\"1\" bgcolor=\"#000000\"><br /></td>\n<td class=\"line1\"></td>\n</tr>\n<tr>\n<td class=\"line2\"><br /></td>\n</tr>\n\n<tr>\n<td class=\"line2\"><br /></td>\n<td rowspan=\"3\">\n<div class=\"menu\" ><!a href=\"http://blog.irako.net/?page_id=6\">Profile</a></div>\n</td>\n</tr>\n<tr>\n<td class=\"line1\"></td>\n</tr>\n<tr>\n<td class=\"line2\"><br /></td>\n</tr>\n\n<!--\n<tr>\n<td><br /></td>\n<td rowspan=\"3\">\n<div class=\"menu\" ><a href=\"http://blog.irako.net/?page_id=32\">Collection</a></div>\n</td>\n</tr>\n<tr>\n<td class=\"line1\"></td>\n</tr>\n<tr>\n<td><br /></td>\n</tr>\n-->\n\n<tr>\n<td class=\"line2\"><br /></td>\n<td rowspan=\"3\">\n<div class=\"menu\" >Sandbox</div>\n</td>\n</tr>\n<tr>\n<td class=\"line1\"></td>\n</tr>\n<tr>\n<td class=\"line2\"><br /></td>\n</tr>\n\n\n<tr>\n<td class=\"line2\"><br /></td>\n<td rowspan=\"3\">\n<div class=\"menu\" ><a href=\"http://twitter.com/#!/irako\">Twitter</a></div>\n</td>\n</tr>\n<tr>\n<td class=\"line1\"></td>\n</tr>\n<tr>\n<td></td>\n<td><br /></td>\n</tr>\n</table>\n\n</td>\n</tr>\n</table>\n\n<div style=\"margin:0 0 0 10px\">\n<hr size=\"1\" width=\"420\" align=\"left\" />\n<a href=\"http://p.twipple.jp/user/irako\">Photo</a> | <a href=\"http://www.bypass.jp/\">Bypass(DSP)</a> | <a href=\"http://ad-stir.com/\">AdStir(SSP)</a>\n</div>\n\n\n</body>\n</html>\n",
"body_murmur": -1559858176,
"body_sha256": "6d0da3d0d3c3cb130e8d8ebeacc8fc4acb2dd9a1d9015f9e6e0e74b9afe6db7f",
"component": [
"Apache HTTP Server"
],
"content_length": 2559,
"headers": {
"accept_ranges": [
"bytes"
],
"content_length": [
"2559"
],
"content_type": [
"text/html"
],
"date": [
"Fri, 26 Dec 2025 23:44:09 GMT"
],
"etag": [
"\"2b60c3-9ff-5c5e51e3c3c40\""
],
"last_modified": [
"Tue, 29 Jun 2021 10:32:09 GMT"
],
"server": [
"Apache"
]
},
"protocol": "HTTP/1.1",
"request": {
"headers": {
"accept": [
"*/*"
],
"user_agent": [
"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
]
},
"method": "GET",
"url": {
"host": "182.48.53.38",
"path": "",
"scheme": "http"
}
},
"status_code": 200,
"title": "irako.net"
}
},
"cve": [
{
"id": "CVE-1999-0070",
"score": 5,
"severity": "medium"
},
{
"id": "CVE-1999-1199",
"score": 10,
"severity": "high"
},
{
"id": "CVE-2023-25690",
"score": 9.8,
"severity": "critical"
}
],
"url": "http://182.48.53.38/",
"_meta": {
"name": "",
"desc": "",
"category": ""
},
"last_updated_at": "2025-12-26T23:44:10.123Z"
},
{
"port": 110,
"protocol": "tcp",
"name": "pop3",
"version": "",
"product": "qmail pop3d",
"extra_info": "",
"tunnel": "",
"softwares": [
{
"uri": "cpe:/a:djb:qmail",
"part": "a",
"vendor": "djb",
"product": "qmail",
"version": "ANY",
"language": "ANY",
"edition": "ANY",
"update": "ANY"
}
],
"modules": {
"pop3": {
"banner": "+OK <[email protected]>\r\n"
}
},
"_meta": {
"name": "",
"desc": "",
"category": ""
},
"last_updated_at": "2025-12-23T05:13:50.32Z"
},
{
"port": 443,
"protocol": "tcp",
"name": "http",
"version": "2.2.3",
"product": "Apache httpd",
"extra_info": "(CentOS)",
"tunnel": "ssl",
"softwares": [
{
"uri": "cpe:/a:apache:http_server:2.2.3",
"part": "a",
"vendor": "apache",
"product": "http_server",
"version": "2\\.2\\.3",
"language": "ANY",
"edition": "ANY",
"update": "ANY"
}
],
"modules": {
"http": {
"body": "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.1//EN\" \"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd\">\n<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"ja\" lang=\"ja\" dir=\"ltr\">\n<head>\n<meta http-equiv=\"content-type\" content=\"text/html; charset=UTF-8\" />\n<meta http-equiv=\"Content-Script-Type\" content=\"text/javascript\" />\n<meta http-equiv=\"Content-Style-Type\" content=\"text/css\" />\n<title>1000文字小説 [1000moji.com]</title>\n<meta name=\"description\" content=\"1000文字以下限定の小説サイト（）\" />\n<meta name=\"keywords\" content=\"1000文字,千文字,1000文字小説,千文字小説,1000字,小説,掌編小説,掌編\" />\n<meta name=\"copyright\" content=\"Copyright(c) xPad Corporation. All rights reserved.\" />\n<meta name=\"robots\" content=\"index, follow\" />\n<meta name=\"author\" content=\"TM\" />\n<meta http-equiv=\"Imagetoolbar\" content=\"no\" />\n<link rel=\"start\" href=\"/\" title=\"1000文字小説 [1000moji.com] トップ\" />\n<link rel=\"stylesheet\" href=\"/js/dojo/dojo/resources/dojo.css\" type=\"text/css\" />\n<link rel=\"stylesheet\" href=\"/js/dojo/dijit/themes/tundra/tundra.css\" type=\"text/css\" />\n<link rel=\"stylesheet\" href=\"/css/default.css\" type=\"text/css\" />\n<link rel=\"shortcut icon\" href=\"/img/favicon.ico\" type=\"image/x-icon\" />\n<link rel=\"icon\" href=\"/favicon.ico\" type=\"image/x-icon\" /> \n<script type=\"text/javascript\" src=\"/js/dojo/dojo/dojo.js\" charset=\"UTF-8\" djConfig=\"parseOnLoad: true\"></script>\n<script type=\"text/javascript\" src=\"/js/common.js\"></script>\n<link rel=\"alternate\" type=\"application/rss+xml\" title=\"1000文字小説 最新ニュース\" href=\"http://blog.xpad.jp/1000moji/atom.xml\" />\n<script type=\"text/javascript\"></script>\n<script data-ad-client=\"ca-pub-2083884787674959\" async src=\"https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js\"></script>\n<script type=\"text/javascript\">\n\n var _gaq = _gaq || [];\n _gaq.push(['_setAccount', 'UA-32905522-1']);\n _gaq.push(['_setDomainName', '1000moji.com']);\n _gaq.push(['_trackPageview']);\n\n (function() {\n var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;\n ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';\n var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);\n })();\n\n</script>\n\n</head>\n<body class=\"tundra\">\n<div class=\"content\">\n\n\t<div class=\"hd clearFloat\">\n\n\t\t<h1 class=\"hd_logo\">\n\t\t\t<a href=\"/\" title=\"1000文字小説\">\n\t\t\t\t<span class=\"none\">1000文字小説</span>\n\t\t\t</a>\n\t\t</h1>\n\t\t<div class=\"hd_banner\">\n\n\n<script type=\"text/javascript\">\nvar adstir_vars = {\n ver: \"4.0\",\n app_id: \"MEDIA-1a4cb9ec\",\n ad_spot: 2,\n center: false\n};\n</script>\n<script type=\"text/javascript\" src=\"https://js.ad-stir.com/js/adstir.js\"></script>\n\n\t\t</div>\n\t</div>\n\t<div class=\"bd\">\n\t\t<div class=\"bd_navi clearFloat\">\n\t\t\t<ul class=\"navi_naviMain clearFloat\"><!--\n\t\t\t--><li id=\"naviMain_top\">\n\t\t\t\t<a href=\"/\" title=\"トップ\">\n\t\t\t\t\t<span class=\"none\">トップ</span>\n\t\t\t\t</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"naviMain_post\">\n\t\t\t\t<a href=\"/mypage/content/post\" title=\"投稿する\">\n\t\t\t\t\t<span class=\"none\">投稿する</span>\n\t\t\t\t</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"naviMain_authors\">\n\t\t\t\t<a href=\"/member\" title=\"作家一覧\">\n\t\t\t\t\t<span class=\"none\">作家一覧</span>\n\t\t\t\t</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"naviMain_novelSearch\">\n\t\t\t\t<span class=\"none\">作品検索</span>\n\t\t\t\t<a href=\"/content/search\" style=\"display: block; width: 85px; height: 40px;\">\n\t\t\t\t\t<span class=\"none\">作品検索</span>\n\t\t\t\t</a>\n\t\t\t\t<form method=\"post\" action=\"/content/search\">\n\t\t\t\t\t<input id=\"input_novelSearch\" name=\"word\" type=\"text\" maxlength=\"255\" value=\"\" />\n\t\t\t\t\t<input id=\"btn_novelSearch\" type=\"image\" src=\"/img/btn/naviMain_search.png\" />\n\t\t\t\t</form>\n\t\t\t</li><!--\n\t\t--></ul>\n\t\t\t<ul class=\"navi_helperMain clearFloat\"><!--\n\t\t\t--><li id=\"helperMain_help\" style=\"border-left: 1px solid #ffffff;\">\n\t\t\t\t<a href=\"/helper/help\" title=\"ヘルプ\">ヘルプ</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"helperMain_loginout\" style=\"border-left: 1px solid #ffffff;\">\n\t\t\t\t<a href=\"/login\" title=\"ログイン\">ログイン</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"helperMain_regist\" style=\"border-left: 1px solid #ffffff;\">\n\t\t\t\t<a href=\"/signup\" title=\"登録する\">登録する</a>\n\t\t\t</li><!--\n\t\t\t--><li id=\"helperMain_loginout\">\n\t\t\t\t<a href=\"/bbs\" title=\"掲示板\">掲示板</a>\n\t\t\t</li><!--\n\t\t--></ul>\n\t\t</div>\n\t\t<div class=\"bd_content clearFloat\">\n\t\t\t<div class=\"content_mainL0Wrap\">\n\t\t\t\t<div class=\"top\"></div>\n\t\t\t\t<div class=\"con\"><div class=\"clearFloat\" style=\"margin-bottom: 15px\">\n\t\t\t\t\t\t<div class=\"mainL0_topL0\">\n\t\t\t\t\t\t\t<div class=\"mainL0_topDesc\">\n\t\t\t\t\t\t\t\t<h2 id=\"topDesc_whatis\">1000文字小説とは？</h2>\n\t\t\t\t\t\t\t\t<div class=\"whatis0\">\n\t\t\t\t\t\t\t\t\t<p>1000文字以内、できれば1000文字ちょうどで書かれた超短編小説です。誰にでも気軽に書ける反面、制限された短さで表現しなければならない難しさもあり、上級者にも初心者にも楽しめる新ジャンル小説です。</p>\n\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t\t<div class=\"clearFloat\">\n\t\t\t\t\t\t\t\t\t<div class=\"whatis1\">\n\t\t\t\t\t\t\t\t\t\t<p>作品または感想（コメント）を投稿するには登録が必要です。閲覧だけなら登録は必要ありません。</p>\n\t\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t\t\t<p class=\"btn_regist0\"><a href=\"/signup\" title=\"ユーザ登録\"><span class=\"none\">ユーザ登録</span></a></p>\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t<div class=\"mainL0_topEvent\">\n\t\t\t\t\t\t\t\t<h3><span class=\"none\">現在開催中のイベント</span></h3>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t<p>現在開催中のイベントはありません。</p>\n\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t</div>\n\t\t\t\t\t\t<div class=\"mainL0_topRemarkAuthor\">\n\t\t\t\t\t\t\t<h2><span class=\"none\">注目の作家さん</span></h2>\n\t\t\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t\t\t<dl>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/member/471\" title=\"\">鹿島正午</a> さん</dt>\n <dd>代表作：<a href=\"/content/11287\">なごり雪</a></dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/member/1257\" title=\"\">もんぞう</a> さん</dt>\n <dd>代表作：<a href=\"/content/8876\">アスファルトの…</a></dd>\n\t\t\t\t\t\t\t\t</dl>\n\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t<div class=\"bottom\"></div>\n\t\t\t\t\t\t</div>\n\t\t\t\t\t</div>\n\t\t\t\t\t<div class=\"clearFloat\" style=\"margin-bottom: 15px;\">\n\t\t\t\t\t\t<div class=\"mainL0_topRemarkNovel\">\n\t\t\t\t\t\t\t<h2>\n\t\t\t\t\t\t\t\t<a href=\"/content/ranking\" title=\"話題の作品\">\n\t\t\t\t\t\t\t\t\t<span class=\"none\">話題の作品</span>\n\t\t\t\t\t\t\t\t</a>\n\t\t\t\t\t\t\t</h2>\n\t\t\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t\t\t<dl>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11287\" title=\"なごり雪\">なごり雪</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRemarkNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/471\">鹿島正午</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRemarkNovel_read\">オレは東京の下町で生まれ育った。 物心ついた頃には、近所に住む雪子という1歳年下の女の子とよく一緒に遊んでいた。 やがて中学生ぐらいになると、お互い照れもあったのか、あまり会…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11387\" title=\"毒と祈りとあの娘\">毒と祈りとあの娘</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRemarkNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1257\">もんぞう</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRemarkNovel_read\">山梨県八幡村。そこはかつて豊かな自然と共生していた場所だったが、今や野生動物、特にクマの出没に怯える日々を送っていた。村の男たちは、法に縛られ、有効な手立てを打てないまま、ただ…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t</dl>\n\t\t\t\t\t\t\t\t<p class=\"txtR\"><a href=\"/content/ranking\" title=\"もっと見る\">>>もっと見る</a>\n\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t<div class=\"bottom\"></div>\n\t\t\t\t\t\t</div>\n\t\t\t\t\t\t<div class=\"mainL0_topRecentNovel\">\n\t\t\t\t\t\t\t<h2>\n\t\t\t\t\t\t\t\t<a href=\"/content/recent\" title=\"新着作品\">\n\t\t\t\t\t\t\t\t\t<span class=\"none\">新着作品</span>\n\t\t\t\t\t\t\t\t</a>\n\t\t\t\t\t\t\t</h2>\n\t\t\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t\t\t<dl>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11387\" title=\"毒と祈りとあの娘\">毒と祈りとあの娘</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1257\">もんぞう</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_read\">山梨県八幡村。そこはかつて豊かな自然と共生していた場所だったが、今や野生動物、特にクマの出没に怯える日々を送っていた。村の男たちは、法に縛られ、有効な手立てを打てないまま、ただ…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11386\" title=\"非常灯の瞳\">非常灯の瞳</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1257\">もんぞう</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_read\">ニュースを見たのは、品川駅の新幹線ホームで列に並んでいる時だった。スマホの画面に 「関東地方、大規模停電の恐れ」という速報が流れる。 私は苦笑した。こんなタイミングで帰省しよう…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11385\" title=\"亡き祖母への手紙67\">亡き祖母への手紙67</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1461\">岡川郁子（ゆうこ)</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_read\">外国は精神科病棟を無くそうと努力している。わが国に精神病院は必要ない。そのように主張する識者がおられますが、日常の中で自身の行うべき基本的な事が出来ない人、家族の手に余る人、家…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11384\" title=\"亡き祖母への手紙66\">亡き祖母への手紙66</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1461\">岡川郁子（ゆうこ)</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_read\">老境を前にした私は、再び若い頃働いた病院へと戻る事になりました。それが良かったのかどうかは分かりません。私が、かつて働いた保育所、粗末な作りの保育所は、もうなくなっていました。…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t\t<dt><a href=\"/content/11383\" title=\"亡き祖母への手紙65\">亡き祖母への手紙65</a></dt>\n\t\t\t\t\t\t\t\t\t<dd>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_author\">作者：\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"/member/1461\">岡川郁子（ゆうこ)</a> さん\n\t\t\t\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t\t\t\t\t<p class=\"topRecentNovel_read\">一部の人々が述べるように、平和を訴える声も、命の尊さを繰り返す組織の言葉も、侵略の方法の一つかもしれないと、今になって感じるようになりました。でも、それを思っても、どうにもなら…</p>\n\t\t\t\t\t\t\t\t\t</dd>\n\t\t\t\t\t\t\t\t</dl>\n\t\t\t\t\t\t\t\t<p class=\"txtR\"><a href=\"/content/recent\" title=\"もっと見る\">>>もっと見る</a>\n\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t<div class=\"bottom\"></div>\n\t\t\t\t\t\t</div>\n\t\t\t\t\t</div>\n\t\t\t\t\t<div class=\"mainL0_topNews\">\n\t\t\t\t\t\t<h2>\n\t\t\t\t\t\t\t<a href=\"http://blog.xpad.jp/1000moji/\" title=\"最新ニュース\">\n\t\t\t\t\t\t\t\t<span class=\"none\">最新ニュース</span>\n\t\t\t\t\t\t\t</a>\n\t\t\t\t\t\t</h2>\n\t\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t\t<dl class=\"clearFloat\">\n\t\t\t\t\t\t\t\t<dt>2009-01-05</dt>\n\t\t\t\t\t\t\t\t<dd>システムメンテナンスのお知らせ ［<!a href=\"http://blog.xpad.jp/1000moji/2009/01/post-8.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-11-04</dt>\n\t\t\t\t\t\t\t\t<dd>『週刊アスキー』11/18号に掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/11/1118.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-10-22</dt>\n\t\t\t\t\t\t\t\t<dd>テレビブロスに掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/10/post-7.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-10-22</dt>\n\t\t\t\t\t\t\t\t<dd>大分合同新聞に掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/10/post-6.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-10-10</dt>\n\t\t\t\t\t\t\t\t<dd>『日経MJ』に掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/10/mj.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-10-07</dt>\n\t\t\t\t\t\t\t\t<dd>『週刊アスキー』に掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/10/post-5.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-10-01</dt>\n\t\t\t\t\t\t\t\t<dd>本日のアップデート ［<!a href=\"http://blog.xpad.jp/1000moji/2008/10/post-4.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-09-30</dt>\n\t\t\t\t\t\t\t\t<dd>本日のアップデート ［<!a href=\"http://blog.xpad.jp/1000moji/2008/09/post-3.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-09-25</dt>\n\t\t\t\t\t\t\t\t<dd>日経産業新聞に掲載されました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/09/post-2.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t\t<dt>2008-09-22</dt>\n\t\t\t\t\t\t\t\t<dd>βオープンしました ［<!a href=\"http://blog.xpad.jp/1000moji/2008/09/post-1.html\" title=\"詳細\">詳細</a>］</dd>\n\t\t\t\t\t\t\t</dl>\n\t\t\t\t\t\t\t<p class=\"txtR\">\n\t\t\t\t\t\t\t\t<!a href=\"http://blog.xpad.jp/1000moji/\" title=\"もっと見る\">>>もっと見る</a>\n\t\t\t\t\t\t\t</p>\n\t\t\t\t\t\t</div>\n\t\t\t\t\t\t<div class=\"bottom\"></div>\n\t\t\t\t\t</div>\n\n\t\t\t\t</div>\n\t\t\t\t<div class=\"bottom\"></div>\n\t\t\t</div>\n\t\t\t<div class=\"content_subR0 clearFloat\">\n\t\t\t\t<div class=\"subR0_banner0\">\n <script type=\"text/javascript\">\n var adstir_vars = {\n ver: \"4.0\",\n app_id: \"MEDIA-1a4cb9ec\",\n ad_spot: 1,\n center: false\n };\n </script>\n <script type=\"text/javascript\" src=\"https://js.ad-stir.com/js/adstir.js\"></script>\n\t\t\t\t</div>\n\t\t\t\t<div class=\"subR0_randomPickup\">\n\t\t\t\t\t<h2 style=\"position: relative;\">ランダムピックアップ (5分間隔更新)</h2>\n\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t<ul><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/1133\" title=\"甲殻類の律動\">甲殻類の律動</a>』 <a href=\"/member/322\" title=\"純さん\" style=\"font-size:smaller;\">純</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/9027\" title=\"野鳥の森の少女 4\">野鳥の森の少女 4</a>』 <a href=\"/member/1025\" title=\"amnesiさん\" style=\"font-size:smaller;\">amnesi</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/3855\" title=\"トモダチ\">トモダチ</a>』 <a href=\"/member/188\" title=\"深刃光さん\" style=\"font-size:smaller;\">深刃光</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/8903\" title=\"赤いスカートのサンタクロース\">赤いスカートのサンタク…</a>』 <a href=\"/member/1170\" title=\"y_fstwさん\" style=\"font-size:smaller;\">y_fstw</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/96\" title=\"ペペロン星人\">ペペロン星人</a>』 <a href=\"/member/43\" title=\"エンドケイプさん\" style=\"font-size:smaller;\">エンドケイプ</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/253\" title=\"モルリ式鉄道広告の発展と普及\">モルリ式鉄道広告の発展…</a>』 <a href=\"/member/151\" title=\"汐留ライスさん\" style=\"font-size:smaller;\">汐留ライス</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/8031\" title=\"別れかけたあなたに送る手紙 ２\">別れかけたあなたに送る…</a>』 <a href=\"/member/1160\" title=\"東京ちんこ倶楽部さん\" style=\"font-size:smaller;\">東京ちんこ倶…</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/3308\" title=\"フジコちゃんはヤリまくっている\">フジコちゃんはヤリまく…</a>』 <a href=\"/member/767\" title=\"ヤマモトＱさん\" style=\"font-size:smaller;\">ヤマモトＱ</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/1727\" title=\"勤労感謝の死\">勤労感謝の死</a>』 <a href=\"/member/38\" title=\"三乗玲さん\" style=\"font-size:smaller;\">三乗玲</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t\t--><li style=\"padding-bottom: 2px;\">\n\t\t\t\t\t\t\t\t『<a href=\"/content/1040\" title=\"集いし勇者達！\">集いし勇者達！</a>』 <a href=\"/member/1\" title=\"systemさん\" style=\"font-size:smaller;\">system</a><span style=\"font-size:smaller;\">さん</span>\n\t\t\t\t\t\t\t</li><!--\n\t\t\t\t\t\t--></ul>\n\t\t\t\t\t</div>\n\t\t\t\t</div>\n\t\t\t\t<div class=\"subR0_tag\">\n\t\t\t\t\t<h2 style=\"position: relative;\">人気タグ<span style=\"position: absolute; right: 5px; text-align: right;\">><a title=\"タグ一覧\" href=\"/tag/\">タグ一覧</a></span></h2>\n\t\t\t\t\t<div class=\"con\">\n\t\t\t\t\t\t<a href=\"/tag/日常\" title=\"日常\">日常</a> \n\t\t\t\t\t\t<a href=\"/tag/恋愛\" title=\"恋愛\">恋愛</a> \n\t\t\t\t\t\t<a href=\"/tag/男女\" title=\"男女\">男女</a> \n\t\t\t\t\t\t<a href=\"/tag/ホラー\" title=\"ホラー\">ホラー</a> \n\t\t\t\t\t\t<a href=\"/tag/不条理\" title=\"不条理\">不条理</a> \n\t\t\t\t\t\t<a href=\"/tag/死\" title=\"死\">死</a> \n\t\t\t\t\t\t<a href=\"/tag/拍手30以上\" title=\"拍手30以上\">拍手30以上</a> \n\t\t\t\t\t\t<a href=\"/tag/拍手50以上\" title=\"拍手50以上\">拍手50以上</a> \n\t\t\t\t\t\t<a href=\"/tag/別れ\" title=\"別れ\">別れ</a> \n\t\t\t\t\t\t<a href=\"/tag/批評可\" title=\"批評可\">批評可</a> \n\t\t\t\t\t\t<a href=\"/tag/SF\" title=\"SF\">SF</a> \n\t\t\t\t\t\t<a href=\"/tag/家族\" title=\"家族\">家族</a> \n\t\t\t\t\t\t<a href=\"/tag/1000文字\" title=\"1000文字\">1000文字</a> \n\t\t\t\t\t\t<a href=\"/tag/拍手10以上\" title=\"拍手10以上\">拍手10以上</a> \n\t\t\t\t\t\t<a href=\"/tag/連作\" title=\"連作\">連作</a> \n\t\t\t\t\t\t<a href=\"/tag/コメディ\" title=\"コメディ\">コメディ</a> \n\t\t\t\t\t\t<a href=\"/tag/人生\" title=\"人生\">人生</a> \n\t\t\t\t\t\t<a href=\"/tag/ファンタジー\" title=\"ファンタジー\">ファンタジー</a> \n\t\t\t\t\t\t<a href=\"/tag/高校生\" title=\"高校生\">高校生</a> \n\t\t\t\t\t\t<a href=\"/tag/孤独\" title=\"孤独\">孤独</a> \n\t\t\t\t\t\t<a href=\"/tag/学校\" title=\"学校\">学校</a> \n\t\t\t\t\t\t<a href=\"/tag/ミステリー\" title=\"ミステリー\">ミステリー</a> \n\t\t\t\t\t\t<a href=\"/tag/狂気\" title=\"狂気\">狂気</a> \n\t\t\t\t\t\t<a href=\"/tag/拍手20以上\" title=\"拍手20以上\">拍手20以上</a> \n\t\t\t\t\t\t<a href=\"/tag/猫\" title=\"猫\">猫</a> \n\t\t\t\t\t\t<a href=\"/tag/夢\" title=\"夢\">夢</a> \n\t\t\t\t\t\t<a href=\"/tag/青春\" title=\"青春\">青春</a> \n\t\t\t\t\t\t<a href=\"/tag/セックス\" title=\"セックス\">セックス</a> \n\t\t\t\t\t\t<a href=\"/tag/幻想\" title=\"幻想\">幻想</a> \n\t\t\t\t\t\t<a href=\"/tag/ショートショート\" title=\"ショートショート\">ショートショート</a> \n\t\t\t\t\t\t<a href=\"/tag/キス\" title=\"キス\">キス</a> \n\t\t\t\t\t\t<a href=\"/tag/人間\" title=\"人間\">人間</a> \n\t\t\t\t\t\t<a href=\"/tag/夫婦\" title=\"夫婦\">夫婦</a> \n\t\t\t\t\t\t<a href=\"/tag/女\" title=\"女\">女</a> \n\t\t\t\t\t\t<a href=\"/tag/自殺\" title=\"自殺\">自殺</a> \n\t\t\t\t\t\t<a href=\"/tag/仕事\" title=\"仕事\">仕事</a> \n\t\t\t\t\t\t<a href=\"/tag/ネタ\" title=\"ネタ\">ネタ</a> \n\t\t\t\t\t\t<a href=\"/tag/愛\" title=\"愛\">愛</a> \n\t\t\t\t\t\t<a href=\"/tag/片思い\" title=\"片思い\">片思い</a> \n\t\t\t\t\t\t<a href=\"/tag/感覚派\" title=\"感覚派\">感覚派</a> \n\t\t\t\t\t\t<a href=\"/tag/雨\" title=\"雨\">雨</a> \n\t\t\t\t\t\t<a href=\"/tag/甘い\" title=\"甘い\">甘い</a> \n\t\t\t\t\t\t<a href=\"/tag/タイムマシーン\" title=\"タイムマシーン\">タイムマシーン</a> \n\t\t\t\t\t\t<a href=\"/tag/官能\" title=\"官能\">官能</a> \n\t\t\t\t\t\t<a href=\"/tag/男\" title=\"男\">男</a> \n\t\t\t\t\t\t<a href=\"/tag/電車\" title=\"電車\">電車</a> \n\t\t\t\t\t\t<a href=\"/tag/作品リクエスト\" title=\"作品リクエスト\">作品リクエスト</a> \n\t\t\t\t\t\t<a href=\"/tag/ＳＦ\" title=\"ＳＦ\">ＳＦ</a> \n\t\t\t\t\t\t<a href=\"/tag/タクシー\" title=\"タクシー\">タクシー</a> \n\t\t\t\t\t\t<a href=\"/tag/夏\" title=\"夏\">夏</a> \n\t\t\t\t\t</div>\n\t\t\t\t</div>\n\t\t\t\t<!-- <div class=\"subR0_qr\"><img src=\"/img/content/qr200-200.png\" alt=\"QRコード\" /></div> -->\n <script type=\"text/javascript\">\n var adstir_vars = {\n ver: \"4.0\",\n app_id: \"MEDIA-1a4cb9ec\",\n ad_spot: 4,\n center: false\n };\n </script>\n <script type=\"text/javascript\" src=\"https://js.ad-stir.com/js/adstir.js\"></script>\n\t\t\t</div>\n\t\t</div>\n\t</div>\n\t<div class=\"ft clearFloat\" style=\"text-align:center;\">\n\n <script type=\"text/javascript\">\n var adstir_vars = {\n ver: \"4.0\",\n app_id: \"MEDIA-1a4cb9ec\",\n ad_spot: 5,\n center: false\n };\n </script>\n <script type=\"text/javascript\" src=\"https://js.ad-stir.com/js/adstir.js\"></script>\n\n\t\t<ul class=\"ft_navi clearFloat\"><!--\n\t\t--><li><a href=\"/helper/termsofuse\" title=\"利用規約\">利用規約</a></li><!--\n\t\t--><li><a href=\"/helper/adsales\" title=\"広告掲載について\">広告掲載について</a></li><!--\n\t\t--><li><a href=\"/helper/help\" title=\"ヘルプ\">ヘルプ</a></li><!--\n\t\t--><li><a href=\"/contact\" title=\"お問い合わせ\">お問い合わせ</a></li><!--\n\t\t--><li style=\"border: none;\"><a href=\"/links\" title=\"リンク\">リンク</a></li><!--\n\t--></ul>\n\t\t<p class=\"txtC\">Copyright©2008 <a href=\"http://1000moji.com/\" title=\"1000moji.com\">1000moji.com</a> All rights reserved.</p>\n\t</div>\n\n</div>\n\n\n\n</body>\n</html>\n",
"body_murmur": 1089521488,
"body_sha256": "7372ce8030004ba3f5e56133a4c200806f4c7b4ea7d626762d8146e32250ee9d",
"component": [
"CentOS",
"Apache HTTP Server:2.2.3"
],
"content_length": -1,
"favicon": {
"md5_hash": "38f3ab4047de15fe6b2b9299bb74c4ee",
"murmur_hash": 547523593,
"path": "https://182.48.53.38:443/favicon.ico",
"size": 894
},
"headers": {
"cache_control": [
"no-cache"
],
"content_type": [
"text/html; charset=UTF-8"
],
"date": [
"Fri, 26 Dec 2025 17:25:03 GMT"
],
"expires": [
"0"
],
"pragma": [
"No-cache"
],
"server": [
"Apache/2.2.3 (CentOS)"
],
"set_cookie": [
"SESSION_ID=e372d98f251b00548c7f8ad18a4eea63; domain=.www.1000moji.com; path=/"
]
},
"protocol": "HTTP/1.1",
"request": {
"headers": {
"accept": [
"*/*"
],
"user_agent": [
"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"
]
},
"method": "GET",
"url": {
"host": "182.48.53.38",
"path": "",
"scheme": "https"
}
},
"status_code": 200,
"title": "1000文字小説 [1000moji.com]",
"transfer_encoding": [
"chunked"
]
},
"tls": {
"certificate": {
"extensions": {
"authority_info_access": {
"issuer_urls": [
"http://secure.globalsign.com/cacert/gsgccr6alphasslca2023.crt"
],
"ocsp_urls": [
"http://ocsp.globalsign.com/gsgccr6alphasslca2023"
]
},
"authority_key_id": "bd05b7f38a933c73cb79fa0f8512a17796189174",
"basic_constraints": {
"is_ca": true
},
"certificate_policies": [
{
"id": "2.23.140.1.2.1"
},
{
"cps": [
"https://www.globalsign.com/repository/"
],
"id": "1.3.6.1.4.1.4146.10.1.3"
}
],
"crl_distribution_points": [
"http://crl.globalsign.com/gsgccr6alphasslca2023.crl"
],
"ct_precert_scts": "Signed Certificate Timestamp:\n Version : v1 (0x0)\n Log ID : 64:11:C4:6C:A4:12:EC:A7:89:1C:A2:02:2E:00:BC:AB:\n 4F:28:07:D4:1E:35:27:AB:EA:FE:D5:03:C9:7D:CD:F0\n Timestamp : Jan 10 12:31:44.465 2025 GMT\n Extensions: none\n Signature : ecdsa-with-SHA256\n 30:45:02:20:67:7D:60:B0:4F:5A:B2:94:38:40:B3:F3:\n C3:49:E3:ED:EA:86:D9:A1:89:69:86:58:FF:3F:30:84:\n 94:1C:B4:F3:02:21:00:EF:A4:E6:30:EF:3D:F3:9A:68:\n 07:F2:15:D6:4C:A9:EE:E6:8A:07:AB:49:C7:BF:3A:37:\n 9D:EB:BA:95:50:D3:9C\nSigned Certificate Timestamp:\n Version : v1 (0x0)\n Log ID : 56:6C:D5:A3:76:BE:83:DF:E3:42:B6:75:C4:9C:23:24:\n 98:A7:69:BA:C3:82:CB:AB:49:A3:87:7D:9A:B3:2D:01\n Timestamp : Jan 10 12:31:44.650 2025 GMT\n Extensions: none\n Signature : ecdsa-with-SHA256\n 30:44:02:20:5A:ED:4B:61:22:11:F4:25:7E:9C:99:A0:\n 4A:D5:15:7E:E6:C3:4A:4F:9C:05:2F:99:6F:0D:82:09:\n 37:A0:E9:D3:02:20:28:BF:A3:1B:90:2B:12:8B:9F:CC:\n C6:7A:99:8F:47:B4:B4:BA:B5:AA:44:BA:57:55:51:68:\n EE:7D:DA:22:78:2A\nSigned Certificate Timestamp:\n Version : v1 (0x0)\n Log ID : 0E:57:94:BC:F3:AE:A9:3E:33:1B:2C:99:07:B3:F7:90:\n DF:9B:C2:3D:71:32:25:DD:21:A9:25:AC:61:C5:4E:21\n Timestamp : Jan 10 12:31:45.228 2025 GMT\n Extensions: none\n Signature : ecdsa-with-SHA256\n 30:45:02:20:5B:86:3D:39:68:A4:46:C0:07:83:6B:B6:\n A6:9D:87:32:13:53:23:57:42:10:33:BB:C1:E9:60:86:\n 55:91:9C:9E:02:21:00:81:2A:08:6E:E8:88:33:52:59:\n 2A:85:51:00:80:9E:46:08:AA:BB:3A:D0:9B:5E:B9:7A:\n 3A:A5:61:14:9C:A5:B3",
"extended_key_usage": {
"any": false,
"apple_code_signing": false,
"apple_code_signing_development": false,
"apple_code_signing_third_party": false,
"apple_crypto_development_env": false,
"apple_crypto_env": false,
"apple_crypto_maintenance_env": false,
"apple_crypto_production_env": false,
"apple_crypto_qos": false,
"apple_crypto_test_env": false,
"apple_crypto_tier0_qos": false,
"apple_crypto_tier1_qos": false,
"apple_crypto_tier2_qos": false,
"apple_crypto_tier3_qos": false,
"apple_ichat_encryption": false,
"apple_ichat_signing": false,
"apple_resource_signing": false,
"apple_software_update_signing": false,
"apple_system_identity": false,
"client_auth": true,
"code_signing": false,
"dvcs": false,
"eap_over_lan": false,
"eap_over_ppp": false,
"email_protection": false,
"ipsec_end_system": false,
"ipsec_intermediate_system_usage": false,
"ipsec_tunnel": false,
"ipsec_user": false,
"microsoft_ca_exchange": false,
"microsoft_cert_trust_list_signing": false,
"microsoft_csp_signature": false,
"microsoft_document_signing": false,
"microsoft_drm": false,
"microsoft_drm_individualization": false,
"microsoft_efs_recovery": false,
"microsoft_embedded_nt_crypto": false,
"microsoft_encrypted_file_system": false,
"microsoft_enrollment_agent": false,
"microsoft_kernel_mode_code_signing": false,
"microsoft_key_recovery_21": false,
"microsoft_key_recovery_3": false,
"microsoft_license_server": false,
"microsoft_licenses": false,
"microsoft_lifetime_signing": false,
"microsoft_mobile_device_software": false,
"microsoft_nt5_crypto": false,
"microsoft_oem_whql_crypto": false,
"microsoft_qualified_subordinate": false,
"microsoft_root_list_signer": false,
"microsoft_server_gated_crypto": false,
"microsoft_sgc_serialized": false,
"microsoft_smart_display": false,
"microsoft_smartcard_logon": false,
"microsoft_system_health": false,
"microsoft_system_health_loophole": false,
"microsoft_timestamp_signing": false,
"microsoft_whql_crypto": false,
"netscape_server_gated_crypto": false,
"ocsp_signing": false,
"sbgp_cert_aa_service_auth": false,
"server_auth": true,
"time_stamping": false
},
"key_usage": {
"certificate_sign": false,
"content_commitment": false,
"crl_sign": false,
"data_encipherment": false,
"decipher_only": false,
"digital_signature": true,
"encipher_only": false,
"key_agreement": false,
"key_encipherment": true
},
"subject_alt_name": {
"dns_names": [
"www.1000moji.com",
"1000moji.com"
]
},
"subject_key_id": "82abcd8e272bd0e9549c758c1e79569e2d80fcd8"
},
"fingerprint_md5": "12A65087F6FDF17D9BC9759FAD6CE640",
"fingerprint_sha1": "E70BFE493EE75C3E5847A6E7668C2C0C61BEAF0F",
"fingerprint_sha256": "6D171EEC5EF6C03FABE8DA202CBB54033557774CE163360077BFB97A374550E6",
"issuer": {
"common_name": [
"GlobalSign GCC R6 AlphaSSL CA 2023"
],
"country": [
"BE"
],
"organization": [
"GlobalSign nv-sa"
]
},
"issuer_dn": "/C=BE/O=GlobalSign nv-sa/CN=GlobalSign GCC R6 AlphaSSL CA 2023",
"jarm": "00000000000000000000000000000000000000000000000000000000000000",
"redacted": false,
"revocation": {
"crl": {
"next_update": "2026-01-01T20:51:39",
"reason": "UNKNOWN",
"revoked": false
},
"ocsp": {
"next_update": "2025-12-30T17:21:47",
"reason": "UNKNOWN",
"revoked": false
}
},
"serial_number": "16327168386487272527740286181",
"signature": {
"algorithm": {
"name": "SHA256-RSA",
"oid": "1.2.840.113549.1.1.11"
},
"self_signed": false,
"value": "NGMxODg2ZDU1MGQ3N2VhNTU3OGNmMTE4ZDdiNTQzMDhjOTYwOGE4MzQ5YWU1MjZjZTBlMmI0ZjMwNzk1OGMyZmNjNGU5YWU5ZmQ2ODAxNzNmNmM3YWE5ZGRiZDQxNDBmYjMzNjRjMWQ0NzdhMTMyNzBkMDZhMjA0NmI5ZWUyZTE1YjRiMGUxZjE4YjA5ZWU4Y2RiMTRiYjc3NTdiZWEyMzJkOTA5ODg4OWM3NDc2YWZmYzYyZDYzODc1OGRjODQyZWZjOTkyYzNiYWJhYThlMWY4NDY1YTMwYTUwMWVkYTljYjNmOGFiOGRlY2E5NGViNDFlNTM2ZDE1MzQwMTU0OGRiNmIxM2QwMjc5NDk0Yjg5ZjQ0YTBhMmIxMTJhYzE4OGQ3MDRkNDZkMmQyODkyZTc2MWU1MDJiMmU1ZTcxZjI2ZjMyZjI2ZmNlYmEwYTI5ZGI5NDY2MGJkZDI1OTZhY2Q2NjJkYzFjYzZhYzA4ZjlmN2VlYzRmYThkNGUzYmJiYzdlNGE4ZTQ2YzVmYWU2MTNjNzMwN2E3OGMzOGVjNTI5ODk2MjJkMTJmNzIyZWE3NjI2M2QxODEwNWE3ZTExMzljYzhhM2Y1MDk2YzQ0YzBiOWM0MTZmMjk1NjQ4NDExZjI5MTQwNzc2MWVhYzkwNjFlYTk1YTVjYmI5ZDNkM2E="
},
"signed_certificate_timestamps": [
{
"entry_type": "PRE_CERTIFICATE",
"log_id": "6411c46ca412eca7891ca2022e00bcab4f2807d41e3527abeafed503c97dcdf0",
"signature": {
"algorithm": "ECDSA",
"hash_algorithm": "SHA256",
"value": "30450220677d60b04f5ab2943840b3f3c349e3edea86d9a189698658ff3f3084941cb4f3022100efa4e630ef3df39a6807f215d64ca9eee68a07ab49c7bf3a379debba9550d39c"
},
"timestamp": "2025-01-10T12:31:44.465000",
"version": "v1"
},
{
"entry_type": "PRE_CERTIFICATE",
"log_id": "566cd5a376be83dfe342b675c49c232498a769bac382cbab49a3877d9ab32d01",
"signature": {
"algorithm": "ECDSA",
"hash_algorithm": "SHA256",
"value": "304402205aed4b612211f4257e9c99a04ad5157ee6c34a4f9c052f996f0d820937a0e9d3022028bfa31b902b128b9fccc67a998f47b4b4bab5aa44ba57555168ee7dda22782a"
},
"timestamp": "2025-01-10T12:31:44.650000",
"version": "v1"
},
{
"entry_type": "PRE_CERTIFICATE",
"log_id": "0e5794bcf3aea93e331b2c9907b3f790df9bc23d713225dd21a925ac61c54e21",
"signature": {
"algorithm": "ECDSA",
"hash_algorithm": "SHA256",
"value": "304502205b863d3968a446c007836bb6a69d873213532357421033bbc1e9608655919c9e022100812a086ee8883352592a855100809e4608aabb3ad09b5eb97a3aa561149ca5b3"
},
"timestamp": "2025-01-10T12:31:45.228000",
"version": "v1"
}
],
"signed_certificate_timestamps_oid": "1.3.6.1.4.1.11129.2.4.2",
"subject": {
"common_name": [
"www.1000moji.com"
]
},
"subject_alt_name": {
"dns_names": [
"www.1000moji.com",
"1000moji.com"
],
"extended_dns_names": [
{
"domain": "1000moji",
"fld": "1000moji.com",
"subdomain": "www",
"tld": "com"
},
{
"domain": "1000moji",
"fld": "1000moji.com",
"tld": "com"
}
]
},
"subject_dn": "/CN=www.1000moji.com",
"subject_key_info": {
"_key": "rsa",
"dh": [],
"dsa": [],
"ecdsa": [],
"fingerprint_sha256": "8a2dae0028724ed24046b47f3c0ea66bb6417228f415f25f58d5a14244248190",
"key_algorithm": "RSA",
"rsa": {
"exponent": 65537,
"length": 2048,
"modulus": "MHg5YWI0ZTBmZjY4OTljNGIwMjliMTkyZWY2YWM3Njg4NmRjNWE0OTczOTI4ZjczNjhmM2RkMzMzMzc0MGIzMDVjZmE4NDI5ZDk4YTIwMDAyZDBkOWM2NWNmNWQ4YjcxZDcxNWY3NDViZTY0NjMyN2UwOTI3YjkyNmI2OTA5MWI3N2YyODgwN2VhMzY4MjJjYmNiZWRmMzdmZGViYzVjMzk0NjEyZmM3NzM4MWNiOGRjMTg4Y2MxOWFiYTJjZjMzMGVlNjc2ZTM5OWRkZjczM2MwODRlOGMxZjA5Mzc0ZGExMzdkNzhjZGEzZWQ2NDBkZmVhOGJjMGI0OGQ0ZmMyMWJlMTRmMDcwNTBmOTExZjIxYTdmZTkyYWM1MmM2NGU4NzhmOWUxZmQ3MDU5MDFkMGRkMTFkNWRkOGM0YjllNTQ3ZGM1NWM4MzI4ZjdkMjczMTA0MTcwZTY0MmYxYmRhMGNhZGY1MzYyMjY0MTM4OGQ0ODQ5Mzk2NGU4NTE2ZDJlODAxNzc0ZTkyNWY1MmY4NjhiOGJmZDY5OTc2MjIyYTYwMGQ5MjM2OGM2N2NhNTEyYzc5YzhjMTRjOTdkNzQ4ZjM2N2NmYmIxYWIzYWM5ZjVmMzc0MTAwN2Q3MTVmOWZkYzRiZjBjYzcyMjdiYTZjZGMzYTllN2JhMTM2Y2M2M2E4MQ=="
}
},
"tbs_fingerprint": "63cc911a77aa5fe474aaa3dcaba482d50288a727407fea87999bc6a41e16d544",
"tbs_noct_fingerprint": "fd10750ddac69ca8fdb027197ef0ff688e734793676d957148fe43b9eadb2620",
"validation_level": "DV",
"validity": {
"length_seconds": 34300800,
"not_after": "2026-02-11T12:31:41",
"not_before": "2025-01-10T12:31:42"
},
"version": 2
},
"fingerprint_sha256": "6D171EEC5EF6C03FABE8DA202CBB54033557774CE163360077BFB97A374550E6",
"precert": false,
"raw": "MIIGYDCCBUigAwIBAgIMNMGEY8Igb9vpjDTlMA0GCSqGSIb3DQEBCwUAMFUxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSswKQYDVQQDEyJHbG9iYWxTaWduIEdDQyBSNiBBbHBoYVNTTCBDQSAyMDIzMB4XDTI1MDExMDEyMzE0MloXDTI2MDIxMTEyMzE0MVowGzEZMBcGA1UEAxMQd3d3LjEwMDBtb2ppLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJq04P9omcSwKbGS72rHaIbcWklzko9zaPPdMzN0CzBc+oQp2YogAC0NnGXPXYtx1xX3Rb5kYyfgknuSa2kJG3fyiAfqNoIsvL7fN/3rxcOUYS/Hc4HLjcGIzBmros8zDuZ245nd9zPAhOjB8JN02hN9eM2j7WQN/qi8C0jU/CG+FPBwUPkR8hp/6SrFLGToePnh/XBZAdDdEdXdjEueVH3FXIMo99JzEEFw5kLxvaDK31NiJkE4jUhJOWToUW0ugBd06SX1L4aLi/1pl2IipgDZI2jGfKUSx5yMFMl9dI82fPuxqzrJ9fN0EAfXFfn9xL8MxyJ7ps3Dqee6E2zGOoECAwEAAaOCA2gwggNkMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMIGZBggrBgEFBQcBAQSBjDCBiTBJBggrBgEFBQcwAoY9aHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3NnY2NyNmFscGhhc3NsY2EyMDIzLmNydDA8BggrBgEFBQcwAYYwaHR0cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNmFscGhhc3NsY2EyMDIzMFcGA1UdIARQME4wCAYGZ4EMAQIBMEIGCisGAQQBoDIKAQMwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wRAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9nc2djY3I2YWxwaGFzc2xjYTIwMjMuY3JsMCkGA1UdEQQiMCCCEHd3dy4xMDAwbW9qaS5jb22CDDEwMDBtb2ppLmNvbTAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUvQW384qTPHPLefoPhRKhd5YYkXQwHQYDVR0OBBYEFIKrzY4nK9DpVJx1jB55Vp4tgPzYMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdgBkEcRspBLsp4kcogIuALyrTygH1B41J6vq/tUDyX3N8AAAAZRQMvVRAAAEAwBHMEUCIGd9YLBPWrKUOECz88NJ4+3qhtmhiWmGWP8/MISUHLTzAiEA76TmMO8985poB/IV1kyp7uaKB6tJx786N53rupVQ05wAdQBWbNWjdr6D3+NCtnXEnCMkmKdpusOCy6tJo4d9mrMtAQAAAZRQMvYKAAAEAwBGMEQCIFrtS2EiEfQlfpyZoErVFX7mw0pPnAUvmW8Nggk3oOnTAiAov6MbkCsSi5/MxnqZj0e0tLq1qkS6V1VRaO592iJ4KgB2AA5XlLzzrqk+MxssmQez95Dfm8I9cTIl3SGpJaxhxU4hAAABlFAy+EwAAAQDAEcwRQIgW4Y9OWikRsAHg2u2pp2HMhNTI1dCEDO7welghlWRnJ4CIQCBKghu6IgzUlkqhVEAgJ5GCKq7OtCbXrl6OqVhFJylszANBgkqhkiG9w0BAQsFAAOCAQEATBiG1VDXfqVXjPEY17VDCMlgioNJrlJs4OK08weVjC/MTprp/WgBc/bHqp3b1BQPszZMHUd6EycNBqIEa57i4VtLDh8YsJ7ozbFLt3V76iMtkJiInHR2r/xi1jh1jchC78mSw7q6qOH4RlowpQHtqcs/irjeypTrQeU20VNAFUjbaxPQJ5SUuJ9EoKKxEqwYjXBNRtLSiS52HlArLl5x8m8y8m/Ougop25RmC90llqzWYtwcxqwI+ffuxPqNTju7x+So5GxfrmE8cwenjDjsUpiWItEvci6nYmPRgQWn4ROcyKP1CWxEwLnEFvKVZIQR8pFAd2HqyQYeqVpcu509Og==",
"tags": [
"dv",
"trusted"
]
}
},
"cve": [
{
"id": "CVE-2006-20001",
"score": 7.5,
"severity": "high"
},
{
"id": "CVE-2006-5752",
"score": 4.3,
"severity": "medium"
},
{
"id": "CVE-2007-1741",
"score": 6.2,
"severity": "medium"
}
],
"url": "https://182.48.53.38/",
"_meta": {
"name": "",
"desc": "",
"category": ""
},
"last_updated_at": "2025-12-26T20:13:48.038Z"
},
{
"port": 2525,
"protocol": "tcp",
"name": "smtp",
"version": "",
"product": "qmail smtpd",
"extra_info": "",
"tunnel": "",
"softwares": [
{
"uri": "cpe:/a:djb:qmail",
"part": "a",
"vendor": "djb",
"product": "qmail",
"version": "ANY",
"language": "ANY",
"edition": "ANY",
"update": "ANY"
}
],
"modules": {
"smtp": {
"banner": "220 s.irako.net ESMTP\r\n"
}
},
"_meta": {
"name": "",
"desc": "",
"category": ""
},
"last_updated_at": "2025-12-24T17:00:21.693Z"
}
],
"services_hash": "91ecced922a54e00b00449ccf416e7e187e4b4a4a0adc76845e2484cd3882304",
"last_updated_at": "2025-12-26T23:44:10.123Z",
"banner": [
"http",
"tls",
"smtp",
"pop3"
],
"is_vuln": true,
"cveDetails": {
"CVE-1999-0070": {
"id": "CVE-1999-0070",
"references": [
"https://lists.apache.org/thread.html/rc5d27fc1e76dc5650e1a3f1db1de403120f4c2d041cb7352850455c2%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc5d27fc1e76dc5650e1a3f1db1de403120f4c2d041cb7352850455c2%40%3Cusers.httpd.apache.org%3E"
],
"score": 5,
"services": [
"80/http"
],
"severity": "medium",
"summary": "test-cgi program allows an attacker to list files on the server.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"weakness": "NVD-CWE-noinfo"
},
"CVE-1999-1199": {
"id": "CVE-1999-1199",
"references": [
"http://marc.info/?l=bugtraq&m=90252779826784&w=2",
"http://marc.info/?l=bugtraq&m=90276683825862&w=2",
"http://marc.info/?l=bugtraq&m=90280517007869&w=2",
"http://marc.info/?l=bugtraq&m=90286768232093&w=2",
"http://www.redhat.com/support/errata/rh51-errata-general.html#apache",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"http://marc.info/?l=bugtraq&m=90252779826784&w=2",
"http://marc.info/?l=bugtraq&m=90276683825862&w=2",
"http://marc.info/?l=bugtraq&m=90280517007869&w=2",
"http://marc.info/?l=bugtraq&m=90286768232093&w=2",
"http://www.redhat.com/support/errata/rh51-errata-general.html#apache",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"
],
"score": 10,
"services": [
"80/http"
],
"severity": "high",
"summary": "Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the \"sioux\" vulnerability.",
"vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"weakness": "NVD-CWE-Other"
},
"CVE-2006-20001": {
"id": "CVE-2006-20001",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.gentoo.org/glsa/202309-01",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.gentoo.org/glsa/202309-01",
"https://security.netapp.com/advisory/ntap-20230316-0005/"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.\n\nThis issue affects Apache HTTP Server 2.4.54 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-787"
},
"CVE-2006-5752": {
"id": "CVE-2006-5752",
"references": [
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://osvdb.org/37052",
"http://rhn.redhat.com/errata/RHSA-2007-0534.html",
"http://rhn.redhat.com/errata/RHSA-2007-0556.html",
"http://secunia.com/advisories/25827",
"http://secunia.com/advisories/25830",
"http://secunia.com/advisories/25873",
"http://secunia.com/advisories/25920",
"http://secunia.com/advisories/26273",
"http://secunia.com/advisories/26443",
"http://secunia.com/advisories/26458",
"http://secunia.com/advisories/26508",
"http://secunia.com/advisories/26822",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27037",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28212",
"http://secunia.com/advisories/28224",
"http://secunia.com/advisories/28606",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
"http://svn.apache.org/viewvc?view=rev&revision=549159",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0532.html",
"http://www.redhat.com/support/errata/RHSA-2007-0557.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/24645",
"http://www.securitytracker.com/id?1018302",
"http://www.trustix.org/errata/2007/0026/",
"http://www.ubuntu.com/usn/usn-499-1",
"http://www.vupen.com/english/advisories/2007/2727",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3386",
"http://www.vupen.com/english/advisories/2007/4305",
"http://www.vupen.com/english/advisories/2008/0233",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/35097",
"https://issues.rpath.com/browse/RPL-1500",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154",
"https://rhn.redhat.com/errata/RHSA-2007-0533.html",
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245112",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://osvdb.org/37052",
"http://rhn.redhat.com/errata/RHSA-2007-0534.html",
"http://rhn.redhat.com/errata/RHSA-2007-0556.html",
"http://secunia.com/advisories/25827",
"http://secunia.com/advisories/25830",
"http://secunia.com/advisories/25873",
"http://secunia.com/advisories/25920",
"http://secunia.com/advisories/26273",
"http://secunia.com/advisories/26443",
"http://secunia.com/advisories/26458",
"http://secunia.com/advisories/26508",
"http://secunia.com/advisories/26822",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27037",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28212",
"http://secunia.com/advisories/28224",
"http://secunia.com/advisories/28606",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
"http://svn.apache.org/viewvc?view=rev&revision=549159",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK49295&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0532.html",
"http://www.redhat.com/support/errata/RHSA-2007-0557.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/24645",
"http://www.securitytracker.com/id?1018302",
"http://www.trustix.org/errata/2007/0026/",
"http://www.ubuntu.com/usn/usn-499-1",
"http://www.vupen.com/english/advisories/2007/2727",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3386",
"http://www.vupen.com/english/advisories/2007/4305",
"http://www.vupen.com/english/advisories/2008/0233",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/35097",
"https://issues.rpath.com/browse/RPL-1500",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10154",
"https://rhn.redhat.com/errata/RHSA-2007-0533.html"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "NVD-CWE-Other"
},
"CVE-2007-1741": {
"id": "CVE-2007-1741",
"references": [
"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
"http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
"http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
"http://osvdb.org/38639",
"http://www.securityfocus.com/bid/23438",
"http://www.securitytracker.com/id?1017904",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/33584"
],
"score": 6.2,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"",
"vector_string": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"weakness": "CWE-362"
},
"CVE-2007-1742": {
"id": "CVE-2007-1742",
"references": [
"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
"http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
"http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
"http://osvdb.org/38640",
"http://www.securitytracker.com/id?1017904"
],
"score": 3.7,
"services": [
"443/http"
],
"severity": "low",
"summary": "suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using \"html_backup\" and \"htmleditor\" under an \"html\" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\"",
"vector_string": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
"weakness": "NVD-CWE-Other"
},
"CVE-2007-1743": {
"id": "CVE-2007-1743",
"references": [
"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511",
"http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2",
"http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2",
"http://www.securitytracker.com/id?1017904"
],
"score": 4.4,
"services": [
"443/http"
],
"severity": "medium",
"summary": "suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because \"the attacks described rely on an insecure server configuration\" in which the user \"has write access to the document root.\" In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.",
"vector_string": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"weakness": "NVD-CWE-Other"
},
"CVE-2007-1863": {
"id": "CVE-2007-1863",
"references": [
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244658",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://osvdb.org/37079",
"http://rhn.redhat.com/errata/RHSA-2007-0534.html",
"http://rhn.redhat.com/errata/RHSA-2007-0556.html",
"http://secunia.com/advisories/25830",
"http://secunia.com/advisories/25873",
"http://secunia.com/advisories/25920",
"http://secunia.com/advisories/26273",
"http://secunia.com/advisories/26443",
"http://secunia.com/advisories/26508",
"http://secunia.com/advisories/26822",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27037",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28606",
"http://secunia.com/advisories/30430",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
"http://svn.apache.org/viewvc?view=rev&revision=535617",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK49355",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:141",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0557.html",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/24649",
"http://www.securitytracker.com/id?1018303",
"http://www.trustix.org/errata/2007/0026/",
"http://www.ubuntu.com/usn/usn-499-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2007/2727",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3386",
"http://www.vupen.com/english/advisories/2008/0233",
"http://www.vupen.com/english/advisories/2008/1697",
"https://issues.rpath.com/browse/RPL-1500",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9824",
"https://rhn.redhat.com/errata/RHSA-2007-0533.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-Other"
},
"CVE-2007-3304": {
"id": "CVE-2007-3304",
"references": [
"ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc",
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e",
"http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2",
"http://osvdb.org/38939",
"http://rhn.redhat.com/errata/RHSA-2007-0556.html",
"http://secunia.com/advisories/25827",
"http://secunia.com/advisories/25830",
"http://secunia.com/advisories/25920",
"http://secunia.com/advisories/26211",
"http://secunia.com/advisories/26273",
"http://secunia.com/advisories/26443",
"http://secunia.com/advisories/26508",
"http://secunia.com/advisories/26611",
"http://secunia.com/advisories/26759",
"http://secunia.com/advisories/26790",
"http://secunia.com/advisories/26822",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27121",
"http://secunia.com/advisories/27209",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28212",
"http://secunia.com/advisories/28224",
"http://secunia.com/advisories/28606",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://security.psnc.pl/files/apache_report.pdf",
"http://securityreason.com/securityalert/2814",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
"http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm",
"http://svn.apache.org/viewvc?view=rev&revision=547987",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/errata/RHSA-2007-0532.html",
"http://www.redhat.com/support/errata/RHSA-2007-0557.html",
"http://www.redhat.com/support/errata/RHSA-2007-0662.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/469899/100/0/threaded",
"http://www.securityfocus.com/archive/1/471832/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/24215",
"http://www.securitytracker.com/id?1018304",
"http://www.trustix.org/errata/2007/0026/",
"http://www.ubuntu.com/usn/usn-499-1",
"http://www.vupen.com/english/advisories/2007/2727",
"http://www.vupen.com/english/advisories/2007/3100",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3420",
"http://www.vupen.com/english/advisories/2007/3494",
"http://www.vupen.com/english/advisories/2007/4305",
"http://www.vupen.com/english/advisories/2008/0233",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/35095",
"https://issues.rpath.com/browse/RPL-1710",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589",
"ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc",
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245111",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://mail-archives.apache.org/mod_mbox/httpd-dev/200706.mbox/%3c20070629141032.GA15192%40redhat.com%3e",
"http://marc.info/?l=apache-httpd-dev&m=118252946632447&w=2",
"http://osvdb.org/38939",
"http://rhn.redhat.com/errata/RHSA-2007-0556.html",
"http://secunia.com/advisories/25827",
"http://secunia.com/advisories/25830",
"http://secunia.com/advisories/25920",
"http://secunia.com/advisories/26211",
"http://secunia.com/advisories/26273",
"http://secunia.com/advisories/26443",
"http://secunia.com/advisories/26508",
"http://secunia.com/advisories/26611",
"http://secunia.com/advisories/26759",
"http://secunia.com/advisories/26790",
"http://secunia.com/advisories/26822",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27121",
"http://secunia.com/advisories/27209",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28212",
"http://secunia.com/advisories/28224",
"http://secunia.com/advisories/28606",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://security.psnc.pl/files/apache_report.pdf",
"http://securityreason.com/securityalert/2814",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103179-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200032-1",
"http://support.avaya.com/elmodocs2/security/ASA-2007-353.htm",
"http://support.avaya.com/elmodocs2/security/ASA-2007-363.htm",
"http://svn.apache.org/viewvc?view=rev&revision=547987",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK53984",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK50467&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:140",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:142",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/errata/RHSA-2007-0532.html",
"http://www.redhat.com/support/errata/RHSA-2007-0557.html",
"http://www.redhat.com/support/errata/RHSA-2007-0662.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/469899/100/0/threaded",
"http://www.securityfocus.com/archive/1/471832/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/24215",
"http://www.securitytracker.com/id?1018304",
"http://www.trustix.org/errata/2007/0026/",
"http://www.ubuntu.com/usn/usn-499-1",
"http://www.vupen.com/english/advisories/2007/2727",
"http://www.vupen.com/english/advisories/2007/3100",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3420",
"http://www.vupen.com/english/advisories/2007/3494",
"http://www.vupen.com/english/advisories/2007/4305",
"http://www.vupen.com/english/advisories/2008/0233",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/35095",
"https://issues.rpath.com/browse/RPL-1710",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11589"
],
"score": 4.7,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"",
"vector_string": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2007-3847": {
"id": "CVE-2007-3847",
"references": [
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://docs.info.apple.com/article.html?artnum=307562",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=apache-cvs&m=118592992309395&w=2",
"http://marc.info/?l=apache-httpd-dev&m=118595556504202&w=2",
"http://marc.info/?l=apache-httpd-dev&m=118595953217856&w=2",
"http://secunia.com/advisories/26636",
"http://secunia.com/advisories/26722",
"http://secunia.com/advisories/26790",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26952",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27209",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27593",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/27882",
"http://secunia.com/advisories/27971",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28606",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/30430",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://support.avaya.com/elmodocs2/security/ASA-2007-500.htm",
"http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK50469",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:235",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0746.html",
"http://www.redhat.com/support/errata/RHSA-2007-0747.html",
"http://www.redhat.com/support/errata/RHSA-2007-0911.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/25489",
"http://www.securitytracker.com/id?1018633",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2007/3020",
"http://www.vupen.com/english/advisories/2007/3095",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3494",
"http://www.vupen.com/english/advisories/2007/3955",
"http://www.vupen.com/english/advisories/2008/0233",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1697",
"https://issues.rpath.com/browse/RPL-1710",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525",
"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html",
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://docs.info.apple.com/article.html?artnum=307562",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=apache-cvs&m=118592992309395&w=2",
"http://marc.info/?l=apache-httpd-dev&m=118595556504202&w=2",
"http://marc.info/?l=apache-httpd-dev&m=118595953217856&w=2",
"http://secunia.com/advisories/26636",
"http://secunia.com/advisories/26722",
"http://secunia.com/advisories/26790",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26952",
"http://secunia.com/advisories/26993",
"http://secunia.com/advisories/27209",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27593",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/27882",
"http://secunia.com/advisories/27971",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28606",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/30430",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://support.avaya.com/elmodocs2/security/ASA-2007-500.htm",
"http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK50469",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK52702",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.html",
"http://www.mandriva.com/security/advisories?name=MDKSA-2007:235",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0746.html",
"http://www.redhat.com/support/errata/RHSA-2007-0747.html",
"http://www.redhat.com/support/errata/RHSA-2007-0911.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/25489",
"http://www.securitytracker.com/id?1018633",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2007/3020",
"http://www.vupen.com/english/advisories/2007/3095",
"http://www.vupen.com/english/advisories/2007/3283",
"http://www.vupen.com/english/advisories/2007/3494",
"http://www.vupen.com/english/advisories/2007/3955",
"http://www.vupen.com/english/advisories/2008/0233",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1697",
"https://issues.rpath.com/browse/RPL-1710",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525",
"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-125"
},
"CVE-2007-4465": {
"id": "CVE-2007-4465",
"references": [
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26952",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/33105",
"http://secunia.com/advisories/35650",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://securityreason.com/achievement_securityalert/46",
"http://securityreason.com/securityalert/3113",
"http://securitytracker.com/id?1019194",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www.apache.org/dist/httpd/CHANGES_2.2.6",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0911.html",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/479237/100/0/threaded",
"http://www.securityfocus.com/bid/25653",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2008/1697",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/36586",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089",
"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html",
"http://bugs.gentoo.org/show_bug.cgi?id=186219",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://secunia.com/advisories/26842",
"http://secunia.com/advisories/26952",
"http://secunia.com/advisories/27563",
"http://secunia.com/advisories/27732",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/33105",
"http://secunia.com/advisories/35650",
"http://security.gentoo.org/glsa/glsa-200711-06.xml",
"http://securityreason.com/achievement_securityalert/46",
"http://securityreason.com/securityalert/3113",
"http://securitytracker.com/id?1019194",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www.apache.org/dist/httpd/CHANGES_2.2.6",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.novell.com/linux/security/advisories/2007_61_apache2.html",
"http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html",
"http://www.redhat.com/support/errata/RHSA-2007-0911.html",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/479237/100/0/threaded",
"http://www.securityfocus.com/bid/25653",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2008/1697",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/36586",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10929",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6089",
"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html"
],
"score": 6.1,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"weakness": "CWE-79"
},
"CVE-2007-5000": {
"id": "CVE-2007-5000",
"references": [
"http://docs.info.apple.com/article.html?artnum=307562",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28046",
"http://secunia.com/advisories/28073",
"http://secunia.com/advisories/28081",
"http://secunia.com/advisories/28196",
"http://secunia.com/advisories/28375",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28525",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28750",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/29806",
"http://secunia.com/advisories/29988",
"http://secunia.com/advisories/30356",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/31142",
"http://secunia.com/advisories/32800",
"http://securitytracker.com/id?1019093",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK58024",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK58074",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
"http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200801e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.osvdb.org/39134",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/494428/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/26838",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2007/4201",
"http://www.vupen.com/english/advisories/2007/4202",
"http://www.vupen.com/english/advisories/2007/4301",
"http://www.vupen.com/english/advisories/2008/0084",
"http://www.vupen.com/english/advisories/2008/0178",
"http://www.vupen.com/english/advisories/2008/0398",
"http://www.vupen.com/english/advisories/2008/0809/references",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1224/references",
"http://www.vupen.com/english/advisories/2008/1623/references",
"http://www.vupen.com/english/advisories/2008/1697",
"http://www.vupen.com/english/advisories/2008/1875/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39001",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39002",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9539",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
"http://docs.info.apple.com/article.html?artnum=307562",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28046",
"http://secunia.com/advisories/28073",
"http://secunia.com/advisories/28081",
"http://secunia.com/advisories/28196",
"http://secunia.com/advisories/28375",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28525",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28750",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/29806",
"http://secunia.com/advisories/29988",
"http://secunia.com/advisories/30356",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/31142",
"http://secunia.com/advisories/32800",
"http://securitytracker.com/id?1019093",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK58024",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK58074",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
"http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200801e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.osvdb.org/39134",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/494428/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/26838",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2007/4201",
"http://www.vupen.com/english/advisories/2007/4202",
"http://www.vupen.com/english/advisories/2007/4301",
"http://www.vupen.com/english/advisories/2008/0084",
"http://www.vupen.com/english/advisories/2008/0178",
"http://www.vupen.com/english/advisories/2008/0398",
"http://www.vupen.com/english/advisories/2008/0809/references",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1224/references",
"http://www.vupen.com/english/advisories/2008/1623/references",
"http://www.vupen.com/english/advisories/2008/1697",
"http://www.vupen.com/english/advisories/2008/1875/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39001",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39002",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9539",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2007-6203": {
"id": "CVE-2007-6203",
"references": [
"http://docs.info.apple.com/article.html?artnum=307562",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://procheckup.com/Vulnerability_PR07-37.php",
"http://secunia.com/advisories/27906",
"http://secunia.com/advisories/28196",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/30356",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/33105",
"http://secunia.com/advisories/34219",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/securityalert/3411",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952",
"http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.html",
"http://www.securityfocus.com/archive/1/484410/100/0/threaded",
"http://www.securityfocus.com/bid/26663",
"http://www.securitytracker.com/id?1019030",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.vupen.com/english/advisories/2007/4060",
"http://www.vupen.com/english/advisories/2007/4301",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1623/references",
"http://www.vupen.com/english/advisories/2008/1875/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/38800",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a \"413 Request Entity Too Large\" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2007-6388": {
"id": "CVE-2007-6388",
"references": [
"http://docs.info.apple.com/article.html?artnum=307562",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/28965",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29504",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/29806",
"http://secunia.com/advisories/29988",
"http://secunia.com/advisories/30356",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/31142",
"http://secunia.com/advisories/32800",
"http://secunia.com/advisories/33200",
"http://securityreason.com/securityalert/3541",
"http://securitytracker.com/id?1019154",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
"http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/488082/100/0/threaded",
"http://www.securityfocus.com/archive/1/488082/100/0/threaded",
"http://www.securityfocus.com/archive/1/494428/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/27237",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2008/0047",
"http://www.vupen.com/english/advisories/2008/0447/references",
"http://www.vupen.com/english/advisories/2008/0554",
"http://www.vupen.com/english/advisories/2008/0809/references",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/0986/references",
"http://www.vupen.com/english/advisories/2008/1224/references",
"http://www.vupen.com/english/advisories/2008/1623/references",
"http://www.vupen.com/english/advisories/2008/1697",
"http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39472",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
"http://docs.info.apple.com/article.html?artnum=307562",
"http://httpd.apache.org/security/vulnerabilities_13.html",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28922",
"http://secunia.com/advisories/28965",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29504",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/29806",
"http://secunia.com/advisories/29988",
"http://secunia.com/advisories/30356",
"http://secunia.com/advisories/30430",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/31142",
"http://secunia.com/advisories/32800",
"http://secunia.com/advisories/33200",
"http://securityreason.com/securityalert/3541",
"http://securitytracker.com/id?1019154",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273",
"http://www-1.ibm.com/support/docview.wss?uid=swg24019245",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.redhat.com/support/errata/RHSA-2008-0261.html",
"http://www.securityfocus.com/archive/1/488082/100/0/threaded",
"http://www.securityfocus.com/archive/1/488082/100/0/threaded",
"http://www.securityfocus.com/archive/1/494428/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/498523/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/27237",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.us-cert.gov/cas/techalerts/TA08-150A.html",
"http://www.vupen.com/english/advisories/2008/0047",
"http://www.vupen.com/english/advisories/2008/0447/references",
"http://www.vupen.com/english/advisories/2008/0554",
"http://www.vupen.com/english/advisories/2008/0809/references",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/0986/references",
"http://www.vupen.com/english/advisories/2008/1224/references",
"http://www.vupen.com/english/advisories/2008/1623/references",
"http://www.vupen.com/english/advisories/2008/1697",
"http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39472",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2007-6420": {
"id": "CVE-2007-6420",
"references": [
"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://secunia.com/advisories/31026",
"http://secunia.com/advisories/32222",
"http://secunia.com/advisories/33797",
"http://secunia.com/advisories/34219",
"http://security.gentoo.org/glsa/glsa-200807-06.xml",
"http://securityreason.com/securityalert/3523",
"http://support.apple.com/kb/HT3216",
"http://www.redhat.com/support/errata/RHSA-2008-0966.html",
"http://www.securityfocus.com/archive/1/486169/100/0/threaded",
"http://www.securityfocus.com/archive/1/494858/100/0/threaded",
"http://www.securityfocus.com/bid/27236",
"http://www.securityfocus.com/bid/31681",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.vupen.com/english/advisories/2008/2780",
"http://www.vupen.com/english/advisories/2009/0320",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8371"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-352"
},
"CVE-2007-6421": {
"id": "CVE-2007-6421",
"references": [
"http://docs.info.apple.com/article.html?artnum=307562",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://securityreason.com/securityalert/3523",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.securityfocus.com/archive/1/486169/100/0/threaded",
"http://www.securityfocus.com/bid/27236",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.vupen.com/english/advisories/2008/0048",
"http://www.vupen.com/english/advisories/2008/0924/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39474",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10664",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8651",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
],
"score": 3.5,
"services": [
"443/http"
],
"severity": "low",
"summary": "Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.",
"vector_string": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2007-6422": {
"id": "CVE-2007-6422",
"references": [
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/29640",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/securityalert/3523",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.securityfocus.com/archive/1/486169/100/0/threaded",
"http://www.securityfocus.com/bid/27236",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.vupen.com/english/advisories/2008/0048",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39476",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10181",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8690",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
],
"score": 4,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.",
"vector_string": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"weakness": "CWE-399"
},
"CVE-2007-6423": {
"id": "CVE-2007-6423",
"references": [
"http://securityreason.com/securityalert/3523",
"http://www.securityfocus.com/archive/1/486169/100/0/threaded",
"http://www.securityfocus.com/bid/27236"
],
"score": 7.8,
"services": [
"443/http"
],
"severity": "high",
"summary": "Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"weakness": "CWE-399"
},
"CVE-2007-6750": {
"id": "CVE-2007-6750",
"references": [
"http://archives.neohapsis.com/archives/bugtraq/2007-01/0229.html",
"http://ha.ckers.org/slowloris/",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://www.securityfocus.com/bid/21865",
"http://www.securitytracker.com/id/1038144",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/72345",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19481",
"http://archives.neohapsis.com/archives/bugtraq/2007-01/0229.html",
"http://ha.ckers.org/slowloris/",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://www.securityfocus.com/bid/21865",
"http://www.securitytracker.com/id/1038144",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/72345",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19481"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-399"
},
"CVE-2008-0005": {
"id": "CVE-2008-0005",
"references": [
"http://docs.info.apple.com/article.html?artnum=307562",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/35650",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/achievement_securityalert/49",
"http://securityreason.com/securityalert/3526",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.securityfocus.com/archive/1/486167/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/27234",
"http://www.securitytracker.com/id?1019185",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1875/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39615",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10812",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html",
"http://docs.info.apple.com/article.html?artnum=307562",
"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html",
"http://lists.vmware.com/pipermail/security-announce/2009/000062.html",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://secunia.com/advisories/28467",
"http://secunia.com/advisories/28471",
"http://secunia.com/advisories/28526",
"http://secunia.com/advisories/28607",
"http://secunia.com/advisories/28749",
"http://secunia.com/advisories/28977",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/29420",
"http://secunia.com/advisories/29640",
"http://secunia.com/advisories/30732",
"http://secunia.com/advisories/35650",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/achievement_securityalert/49",
"http://securityreason.com/securityalert/3526",
"http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:014",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:015",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:016",
"http://www.redhat.com/support/errata/RHSA-2008-0004.html",
"http://www.redhat.com/support/errata/RHSA-2008-0005.html",
"http://www.redhat.com/support/errata/RHSA-2008-0006.html",
"http://www.redhat.com/support/errata/RHSA-2008-0007.html",
"http://www.redhat.com/support/errata/RHSA-2008-0008.html",
"http://www.redhat.com/support/errata/RHSA-2008-0009.html",
"http://www.securityfocus.com/archive/1/486167/100/0/threaded",
"http://www.securityfocus.com/archive/1/505990/100/0/threaded",
"http://www.securityfocus.com/bid/27234",
"http://www.securitytracker.com/id?1019185",
"http://www.ubuntu.com/usn/usn-575-1",
"http://www.vupen.com/english/advisories/2008/0924/references",
"http://www.vupen.com/english/advisories/2008/1875/references",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39615",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10812",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2008-0455": {
"id": "CVE-2008-0455",
"references": [
"http://rhn.redhat.com/errata/RHSA-2012-1591.html",
"http://rhn.redhat.com/errata/RHSA-2012-1592.html",
"http://rhn.redhat.com/errata/RHSA-2012-1594.html",
"http://rhn.redhat.com/errata/RHSA-2013-0130.html",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/51607",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/securityalert/3575",
"http://securitytracker.com/id?1019256",
"http://www.mindedsecurity.com/MSA01150108.html",
"http://www.securityfocus.com/archive/1/486847/100/0/threaded",
"http://www.securityfocus.com/bid/27409",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39867",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2008-0456": {
"id": "CVE-2008-0456",
"references": [
"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
"http://rhn.redhat.com/errata/RHSA-2013-0130.html",
"http://secunia.com/advisories/29348",
"http://secunia.com/advisories/35074",
"http://security.gentoo.org/glsa/glsa-200803-19.xml",
"http://securityreason.com/securityalert/3575",
"http://securitytracker.com/id?1019256",
"http://support.apple.com/kb/HT3549",
"http://www.mindedsecurity.com/MSA01150108.html",
"http://www.securityfocus.com/archive/1/486847/100/0/threaded",
"http://www.securityfocus.com/bid/27409",
"http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
"http://www.vupen.com/english/advisories/2009/1297",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/39893",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 2.6,
"services": [
"443/http"
],
"severity": "low",
"summary": "CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) \"406 Not Acceptable\" or (2) \"300 Multiple Choices\" HTTP response when the extension is omitted in a request for the file.",
"vector_string": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"weakness": "CWE-74"
},
"CVE-2008-2168": {
"id": "CVE-2008-2168",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/35650",
"http://securityreason.com/securityalert/3889",
"http://www.securityfocus.com/archive/1/491862/100/0/threaded",
"http://www.securityfocus.com/archive/1/491901/100/0/threaded",
"http://www.securityfocus.com/archive/1/491930/100/0/threaded",
"http://www.securityfocus.com/archive/1/491967/100/0/threaded",
"http://www.securityfocus.com/bid/29112",
"http://www.ubuntu.com/usn/USN-731-1",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=124654546101607&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/35650",
"http://securityreason.com/securityalert/3889",
"http://www.securityfocus.com/archive/1/491862/100/0/threaded",
"http://www.securityfocus.com/archive/1/491901/100/0/threaded",
"http://www.securityfocus.com/archive/1/491930/100/0/threaded",
"http://www.securityfocus.com/archive/1/491967/100/0/threaded",
"http://www.securityfocus.com/bid/29112",
"http://www.ubuntu.com/usn/USN-731-1",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/42303",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5143"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2008-2364": {
"id": "CVE-2008-2364",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://rhn.redhat.com/errata/RHSA-2008-0967.html",
"http://secunia.com/advisories/30621",
"http://secunia.com/advisories/31026",
"http://secunia.com/advisories/31404",
"http://secunia.com/advisories/31416",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/31904",
"http://secunia.com/advisories/32222",
"http://secunia.com/advisories/32685",
"http://secunia.com/advisories/32838",
"http://secunia.com/advisories/33156",
"http://secunia.com/advisories/33797",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/34259",
"http://secunia.com/advisories/34418",
"http://security.gentoo.org/glsa/glsa-200807-06.xml",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
"http://support.apple.com/kb/HT3216",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
"http://www-01.ibm.com/support/docview.wss?uid=swg27008517",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK67579",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:237",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2008-0966.html",
"http://www.securityfocus.com/archive/1/494858/100/0/threaded",
"http://www.securityfocus.com/archive/1/498567/100/0/threaded",
"http://www.securityfocus.com/bid/29653",
"http://www.securityfocus.com/bid/31681",
"http://www.securitytracker.com/id?1020267",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.vupen.com/english/advisories/2008/1798",
"http://www.vupen.com/english/advisories/2008/2780",
"http://www.vupen.com/english/advisories/2009/0320",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/42987",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11713",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6084",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9577",
"https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00153.html",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432",
"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://rhn.redhat.com/errata/RHSA-2008-0967.html",
"http://secunia.com/advisories/30621",
"http://secunia.com/advisories/31026",
"http://secunia.com/advisories/31404",
"http://secunia.com/advisories/31416",
"http://secunia.com/advisories/31651",
"http://secunia.com/advisories/31904",
"http://secunia.com/advisories/32222",
"http://secunia.com/advisories/32685",
"http://secunia.com/advisories/32838",
"http://secunia.com/advisories/33156",
"http://secunia.com/advisories/33797",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/34259",
"http://secunia.com/advisories/34418",
"http://security.gentoo.org/glsa/glsa-200807-06.xml",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
"http://support.apple.com/kb/HT3216",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=666154&r2=666153&pathrev=666154",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
"http://www-01.ibm.com/support/docview.wss?uid=swg27008517",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK67579",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:237",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2008-0966.html",
"http://www.securityfocus.com/archive/1/494858/100/0/threaded",
"http://www.securityfocus.com/archive/1/498567/100/0/threaded",
"http://www.securityfocus.com/bid/29653",
"http://www.securityfocus.com/bid/31681",
"http://www.securitytracker.com/id?1020267",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.vupen.com/english/advisories/2008/1798",
"http://www.vupen.com/english/advisories/2008/2780",
"http://www.vupen.com/english/advisories/2009/0320",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/42987",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11713",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6084",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9577",
"https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.html",
"https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00153.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-770"
},
"CVE-2008-2939": {
"id": "CVE-2008-2939",
"references": [
"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://rhn.redhat.com/errata/RHSA-2008-0967.html",
"http://secunia.com/advisories/31384",
"http://secunia.com/advisories/31673",
"http://secunia.com/advisories/32685",
"http://secunia.com/advisories/32838",
"http://secunia.com/advisories/33156",
"http://secunia.com/advisories/33797",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/35074",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
"http://support.apple.com/kb/HT3549",
"http://svn.apache.org/viewvc?view=rev&revision=682868",
"http://svn.apache.org/viewvc?view=rev&revision=682870",
"http://svn.apache.org/viewvc?view=rev&revision=682871",
"http://wiki.rpath.com/Advisories:rPSA-2008-0327",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK70197",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK70937",
"http://www.kb.cert.org/vuls/id/663763",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:194",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
"http://www.rapid7.com/advisories/R7-0033",
"http://www.redhat.com/support/errata/RHSA-2008-0966.html",
"http://www.securityfocus.com/archive/1/495180/100/0/threaded",
"http://www.securityfocus.com/archive/1/498566/100/0/threaded",
"http://www.securityfocus.com/archive/1/498567/100/0/threaded",
"http://www.securityfocus.com/bid/30560",
"http://www.securitytracker.com/id?1020635",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
"http://www.vupen.com/english/advisories/2008/2315",
"http://www.vupen.com/english/advisories/2008/2461",
"http://www.vupen.com/english/advisories/2009/0320",
"http://www.vupen.com/english/advisories/2009/1297",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/44223",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11316",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7716",
"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html",
"http://marc.info/?l=bugtraq&m=123376588623823&w=2",
"http://marc.info/?l=bugtraq&m=125631037611762&w=2",
"http://rhn.redhat.com/errata/RHSA-2008-0967.html",
"http://secunia.com/advisories/31384",
"http://secunia.com/advisories/31673",
"http://secunia.com/advisories/32685",
"http://secunia.com/advisories/32838",
"http://secunia.com/advisories/33156",
"http://secunia.com/advisories/33797",
"http://secunia.com/advisories/34219",
"http://secunia.com/advisories/35074",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1",
"http://support.apple.com/kb/HT3549",
"http://svn.apache.org/viewvc?view=rev&revision=682868",
"http://svn.apache.org/viewvc?view=rev&revision=682870",
"http://svn.apache.org/viewvc?view=rev&revision=682871",
"http://wiki.rpath.com/Advisories:rPSA-2008-0327",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0328",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK70197",
"http://www-1.ibm.com/support/docview.wss?uid=swg1PK70937",
"http://www.kb.cert.org/vuls/id/663763",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:194",
"http://www.mandriva.com/security/advisories?name=MDVSA-2008:195",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
"http://www.rapid7.com/advisories/R7-0033",
"http://www.redhat.com/support/errata/RHSA-2008-0966.html",
"http://www.securityfocus.com/archive/1/495180/100/0/threaded",
"http://www.securityfocus.com/archive/1/498566/100/0/threaded",
"http://www.securityfocus.com/archive/1/498567/100/0/threaded",
"http://www.securityfocus.com/bid/30560",
"http://www.securitytracker.com/id?1020635",
"http://www.ubuntu.com/usn/USN-731-1",
"http://www.us-cert.gov/cas/techalerts/TA09-133A.html",
"http://www.vupen.com/english/advisories/2008/2315",
"http://www.vupen.com/english/advisories/2008/2461",
"http://www.vupen.com/english/advisories/2009/0320",
"http://www.vupen.com/english/advisories/2009/1297",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/44223",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11316",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7716"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2009-0023": {
"id": "CVE-2009-0023",
"references": [
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://secunia.com/advisories/34724",
"http://secunia.com/advisories/35284",
"http://secunia.com/advisories/35360",
"http://secunia.com/advisories/35395",
"http://secunia.com/advisories/35444",
"http://secunia.com/advisories/35487",
"http://secunia.com/advisories/35565",
"http://secunia.com/advisories/35710",
"http://secunia.com/advisories/35797",
"http://secunia.com/advisories/35843",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-03.xml",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc?view=rev&revision=779880",
"http://wiki.rpath.com/Advisories:rPSA-2009-0144",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
"http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.debian.org/security/2009/dsa-1812",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2009-1107.html",
"http://www.redhat.com/support/errata/RHSA-2009-1108.html",
"http://www.securityfocus.com/archive/1/507855/100/0/threaded",
"http://www.securityfocus.com/bid/35221",
"http://www.ubuntu.com/usn/usn-786-1",
"http://www.ubuntu.com/usn/usn-787-1",
"http://www.vupen.com/english/advisories/2009/1907",
"http://www.vupen.com/english/advisories/2009/3184",
"https://bugzilla.redhat.com/show_bug.cgi?id=503928",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/50964",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10968",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12321",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"weakness": "CWE-119"
},
"CVE-2009-1195": {
"id": "CVE-2009-1195",
"references": [
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=apache-httpd-dev&m=124048996106302&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://osvdb.org/54733",
"http://secunia.com/advisories/35261",
"http://secunia.com/advisories/35264",
"http://secunia.com/advisories/35395",
"http://secunia.com/advisories/35453",
"http://secunia.com/advisories/35721",
"http://secunia.com/advisories/37152",
"http://security.gentoo.org/glsa/glsa-200907-04.xml",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc?view=rev&revision=772997",
"http://wiki.rpath.com/Advisories:rPSA-2009-0142",
"http://www.debian.org/security/2009/dsa-1816",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:124",
"http://www.redhat.com/support/errata/RHSA-2009-1075.html",
"http://www.redhat.com/support/errata/RHSA-2009-1156.html",
"http://www.securityfocus.com/archive/1/507852/100/0/threaded",
"http://www.securityfocus.com/archive/1/507857/100/0/threaded",
"http://www.securityfocus.com/bid/35115",
"http://www.securitytracker.com/id?1022296",
"http://www.ubuntu.com/usn/usn-787-1",
"http://www.vupen.com/english/advisories/2009/1444",
"http://www.vupen.com/english/advisories/2009/3184",
"https://bugzilla.redhat.com/show_bug.cgi?id=489436",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/50808",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11094",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12377",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8704",
"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
],
"score": 4.9,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.",
"vector_string": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"weakness": "CWE-16"
},
"CVE-2009-1890": {
"id": "CVE-2009-1890",
"references": [
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://osvdb.org/55553",
"http://secunia.com/advisories/35691",
"http://secunia.com/advisories/35721",
"http://secunia.com/advisories/35793",
"http://secunia.com/advisories/35865",
"http://secunia.com/advisories/37152",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-04.xml",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?revision=790587",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=790587&r2=790586&pathrev=790587",
"http://svn.apache.org/viewvc?view=rev&revision=790587",
"http://wiki.rpath.com/Advisories:rPSA-2009-0142",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91259",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
"http://www.debian.org/security/2009/dsa-1834",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2009-1156.html",
"http://www.securityfocus.com/archive/1/507852/100/0/threaded",
"http://www.securityfocus.com/archive/1/507857/100/0/threaded",
"http://www.securityfocus.com/bid/35565",
"http://www.securitytracker.com/id?1022509",
"http://www.ubuntu.com/usn/USN-802-1",
"http://www.vupen.com/english/advisories/2009/3184",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb33be0aa9bd8cac9536293e3821dcd4cf8180ad95a8036eedd46365e%40%3Cusers.mina.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12330",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8616",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9403",
"https://rhn.redhat.com/errata/RHSA-2009-1148.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
],
"score": 7.1,
"services": [
"443/http"
],
"severity": "high",
"summary": "The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
"weakness": "CWE-400"
},
"CVE-2009-1891": {
"id": "CVE-2009-1891",
"references": [
"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712",
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2",
"http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://osvdb.org/55782",
"http://secunia.com/advisories/35721",
"http://secunia.com/advisories/35781",
"http://secunia.com/advisories/35793",
"http://secunia.com/advisories/35865",
"http://secunia.com/advisories/37152",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-04.xml",
"http://support.apple.com/kb/HT3937",
"http://wiki.rpath.com/Advisories:rPSA-2009-0142",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
"http://www.debian.org/security/2009/dsa-1834",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
"http://www.redhat.com/support/errata/RHSA-2009-1156.html",
"http://www.securityfocus.com/archive/1/507857/100/0/threaded",
"http://www.securitytracker.com/id?1022529",
"http://www.ubuntu.com/usn/USN-802-1",
"http://www.vupen.com/english/advisories/2009/1841",
"http://www.vupen.com/english/advisories/2009/3184",
"https://bugzilla.redhat.com/show_bug.cgi?id=509125",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248",
"https://rhn.redhat.com/errata/RHSA-2009-1148.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html",
"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712",
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2",
"http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://osvdb.org/55782",
"http://secunia.com/advisories/35721",
"http://secunia.com/advisories/35781",
"http://secunia.com/advisories/35793",
"http://secunia.com/advisories/35865",
"http://secunia.com/advisories/37152",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-04.xml",
"http://support.apple.com/kb/HT3937",
"http://wiki.rpath.com/Advisories:rPSA-2009-0142",
"http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0142",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91361",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99480",
"http://www.debian.org/security/2009/dsa-1834",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:149",
"http://www.redhat.com/support/errata/RHSA-2009-1156.html",
"http://www.securityfocus.com/archive/1/507857/100/0/threaded",
"http://www.securitytracker.com/id?1022529",
"http://www.ubuntu.com/usn/USN-802-1",
"http://www.vupen.com/english/advisories/2009/1841",
"http://www.vupen.com/english/advisories/2009/3184",
"https://bugzilla.redhat.com/show_bug.cgi?id=509125",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12361",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8632",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9248",
"https://rhn.redhat.com/errata/RHSA-2009-1148.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01363.html"
],
"score": 7.1,
"services": [
"443/http"
],
"severity": "high",
"summary": "The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
"weakness": "CWE-400"
},
"CVE-2009-1955": {
"id": "CVE-2009-1955",
"references": [
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://marc.info/?l=apr-dev&m=124396021826125&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://secunia.com/advisories/34724",
"http://secunia.com/advisories/35284",
"http://secunia.com/advisories/35360",
"http://secunia.com/advisories/35395",
"http://secunia.com/advisories/35444",
"http://secunia.com/advisories/35487",
"http://secunia.com/advisories/35565",
"http://secunia.com/advisories/35710",
"http://secunia.com/advisories/35797",
"http://secunia.com/advisories/35843",
"http://secunia.com/advisories/36473",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-03.xml",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc?view=rev&revision=781403",
"http://wiki.rpath.com/Advisories:rPSA-2009-0123",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
"http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.debian.org/security/2009/dsa-1812",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.openwall.com/lists/oss-security/2009/06/03/4",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2009-1107.html",
"http://www.redhat.com/support/errata/RHSA-2009-1108.html",
"http://www.securityfocus.com/archive/1/506053/100/0/threaded",
"http://www.securityfocus.com/bid/35253",
"http://www.ubuntu.com/usn/usn-786-1",
"http://www.ubuntu.com/usn/usn-787-1",
"http://www.vupen.com/english/advisories/2009/1907",
"http://www.vupen.com/english/advisories/2009/3184",
"http://www.vupen.com/english/advisories/2010/1107",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473",
"https://www.exploit-db.com/exploits/8842",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html",
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://marc.info/?l=apr-dev&m=124396021826125&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://secunia.com/advisories/34724",
"http://secunia.com/advisories/35284",
"http://secunia.com/advisories/35360",
"http://secunia.com/advisories/35395",
"http://secunia.com/advisories/35444",
"http://secunia.com/advisories/35487",
"http://secunia.com/advisories/35565",
"http://secunia.com/advisories/35710",
"http://secunia.com/advisories/35797",
"http://secunia.com/advisories/35843",
"http://secunia.com/advisories/36473",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-03.xml",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc?view=rev&revision=781403",
"http://wiki.rpath.com/Advisories:rPSA-2009-0123",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK88342",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
"http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.debian.org/security/2009/dsa-1812",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.openwall.com/lists/oss-security/2009/06/03/4",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2009-1107.html",
"http://www.redhat.com/support/errata/RHSA-2009-1108.html",
"http://www.securityfocus.com/archive/1/506053/100/0/threaded",
"http://www.securityfocus.com/bid/35253",
"http://www.ubuntu.com/usn/usn-786-1",
"http://www.ubuntu.com/usn/usn-787-1",
"http://www.vupen.com/english/advisories/2009/1907",
"http://www.vupen.com/english/advisories/2009/3184",
"http://www.vupen.com/english/advisories/2010/1107",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473",
"https://www.exploit-db.com/exploits/8842",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-776"
},
"CVE-2009-1956": {
"id": "CVE-2009-1956",
"references": [
"http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://secunia.com/advisories/34724",
"http://secunia.com/advisories/35284",
"http://secunia.com/advisories/35395",
"http://secunia.com/advisories/35487",
"http://secunia.com/advisories/35565",
"http://secunia.com/advisories/35710",
"http://secunia.com/advisories/35797",
"http://secunia.com/advisories/35843",
"http://secunia.com/advisories/37221",
"http://security.gentoo.org/glsa/glsa-200907-03.xml",
"http://support.apple.com/kb/HT3937",
"http://svn.apache.org/viewvc?view=rev&revision=768417",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478",
"http://www-01.ibm.com/support/docview.wss?uid=swg27014463",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.mail-archive.com/dev%40apr.apache.org/msg21591.html",
"http://www.mail-archive.com/dev%40apr.apache.org/msg21592.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:131",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.openwall.com/lists/oss-security/2009/06/06/1",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2009-1107.html",
"http://www.redhat.com/support/errata/RHSA-2009-1108.html",
"http://www.securityfocus.com/bid/35251",
"http://www.ubuntu.com/usn/usn-786-1",
"http://www.ubuntu.com/usn/usn-787-1",
"http://www.vupen.com/english/advisories/2009/1907",
"http://www.vupen.com/english/advisories/2009/3184",
"https://bugzilla.redhat.com/show_bug.cgi?id=504390",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11567",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12237",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html"
],
"score": 6.4,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.",
"vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"weakness": "CWE-189"
},
"CVE-2009-2699": {
"id": "CVE-2009-2699",
"references": [
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://securitytracker.com/id?1022988",
"http://www.apache.org/dist/httpd/CHANGES_2.2.14",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.securityfocus.com/bid/36596",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/53666",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=47645",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-667"
},
"CVE-2009-3094": {
"id": "CVE-2009-3094",
"references": [
"http://intevydis.com/vd-list.shtml",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/36549",
"http://secunia.com/advisories/37152",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK96858",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.intevydis.com/blog/?p=59",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"http://www.vupen.com/english/advisories/2010/0609",
"https://bugzilla.redhat.com/show_bug.cgi?id=521619",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10981",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8087",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
"http://intevydis.com/vd-list.shtml",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/36549",
"http://secunia.com/advisories/37152",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PK96858",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.intevydis.com/blog/?p=59",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"http://www.vupen.com/english/advisories/2010/0609",
"https://bugzilla.redhat.com/show_bug.cgi?id=521619",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10981",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8087",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
],
"score": 2.6,
"services": [
"443/http"
],
"severity": "low",
"summary": "The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.",
"vector_string": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"weakness": "CWE-476"
},
"CVE-2009-3095": {
"id": "CVE-2009-3095",
"references": [
"http://intevydis.com/vd-list.shtml",
"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/37152",
"http://support.apple.com/kb/HT4077",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"https://bugzilla.redhat.com/show_bug.cgi?id=522209",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
"http://intevydis.com/vd-list.shtml",
"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html",
"http://marc.info/?l=bugtraq&m=126998684522511&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/37152",
"http://support.apple.com/kb/HT4077",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"https://bugzilla.redhat.com/show_bug.cgi?id=522209",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8662",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9363",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"weakness": "NVD-CWE-Other"
},
"CVE-2009-3555": {
"id": "CVE-2009-3555",
"references": [
"http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html",
"http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html",
"http://blogs.iss.net/archive/sslmitmiscsrf.html",
"http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during",
"http://clicky.me/tlsvuln",
"http://extendedsubset.com/?p=8",
"http://extendedsubset.com/Renegotiating_TLS.pdf",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041",
"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751",
"http://kbase.redhat.com/faq/docs/DOC-20491",
"http://lists.apple.com/archives/security-announce/2010//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2010//May/msg00002.html",
"http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html",
"http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html",
"http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2",
"http://marc.info/?l=bugtraq&m=126150535619567&w=2",
"http://marc.info/?l=bugtraq&m=127128920008563&w=2",
"http://marc.info/?l=bugtraq&m=127419602507642&w=2",
"http://marc.info/?l=bugtraq&m=127557596201693&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=132077688910227&w=2",
"http://marc.info/?l=bugtraq&m=133469267822771&w=2",
"http://marc.info/?l=bugtraq&m=134254866602253&w=2",
"http://marc.info/?l=bugtraq&m=142660345230545&w=2",
"http://marc.info/?l=cryptography&m=125752275331877&w=2",
"http://openbsd.org/errata45.html#010_openssl",
"http://openbsd.org/errata46.html#004_openssl",
"http://osvdb.org/60521",
"http://osvdb.org/60972",
"http://osvdb.org/62210",
"http://osvdb.org/65202",
"http://seclists.org/fulldisclosure/2009/Nov/139",
"http://secunia.com/advisories/37291",
"http://secunia.com/advisories/37292",
"http://secunia.com/advisories/37320",
"http://secunia.com/advisories/37383",
"http://secunia.com/advisories/37399",
"http://secunia.com/advisories/37453",
"http://secunia.com/advisories/37501",
"http://secunia.com/advisories/37504",
"http://secunia.com/advisories/37604",
"http://secunia.com/advisories/37640",
"http://secunia.com/advisories/37656",
"http://secunia.com/advisories/37675",
"http://secunia.com/advisories/37859",
"http://secunia.com/advisories/38003",
"http://secunia.com/advisories/38020",
"http://secunia.com/advisories/38056",
"http://secunia.com/advisories/38241",
"http://secunia.com/advisories/38484",
"http://secunia.com/advisories/38687",
"http://secunia.com/advisories/38781",
"http://secunia.com/advisories/39127",
"http://secunia.com/advisories/39136",
"http://secunia.com/advisories/39242",
"http://secunia.com/advisories/39243",
"http://secunia.com/advisories/39278",
"http://secunia.com/advisories/39292",
"http://secunia.com/advisories/39317",
"http://secunia.com/advisories/39461",
"http://secunia.com/advisories/39500",
"http://secunia.com/advisories/39628",
"http://secunia.com/advisories/39632",
"http://secunia.com/advisories/39713",
"http://secunia.com/advisories/39819",
"http://secunia.com/advisories/40070",
"http://secunia.com/advisories/40545",
"http://secunia.com/advisories/40747",
"http://secunia.com/advisories/40866",
"http://secunia.com/advisories/41480",
"http://secunia.com/advisories/41490",
"http://secunia.com/advisories/41818",
"http://secunia.com/advisories/41967",
"http://secunia.com/advisories/41972",
"http://secunia.com/advisories/42377",
"http://secunia.com/advisories/42379",
"http://secunia.com/advisories/42467",
"http://secunia.com/advisories/42724",
"http://secunia.com/advisories/42733",
"http://secunia.com/advisories/42808",
"http://secunia.com/advisories/42811",
"http://secunia.com/advisories/42816",
"http://secunia.com/advisories/43308",
"http://secunia.com/advisories/44183",
"http://secunia.com/advisories/44954",
"http://secunia.com/advisories/48577",
"http://security.gentoo.org/glsa/glsa-200912-01.xml",
"http://security.gentoo.org/glsa/glsa-201203-22.xml",
"http://security.gentoo.org/glsa/glsa-201406-32.xml",
"http://securitytracker.com/id?1023148",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1",
"http://support.apple.com/kb/HT4004",
"http://support.apple.com/kb/HT4170",
"http://support.apple.com/kb/HT4171",
"http://support.avaya.com/css/P8/documents/100070150",
"http://support.avaya.com/css/P8/documents/100081611",
"http://support.avaya.com/css/P8/documents/100114315",
"http://support.avaya.com/css/P8/documents/100114327",
"http://support.citrix.com/article/CTX123359",
"http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES",
"http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released",
"http://sysoev.ru/nginx/patch.cve-2009-3555.txt",
"http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html",
"http://ubuntu.com/usn/usn-923-1",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www-01.ibm.com/support/docview.wss?uid=swg21426108",
"http://www-01.ibm.com/support/docview.wss?uid=swg21432298",
"http://www-01.ibm.com/support/docview.wss?uid=swg24006386",
"http://www-01.ibm.com/support/docview.wss?uid=swg24025312",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only",
"http://www.arubanetworks.com/support/alerts/aid-020810.txt",
"http://www.betanews.com/article/1257452450",
"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.debian.org/security/2011/dsa-2141",
"http://www.debian.org/security/2015/dsa-3253",
"http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html",
"http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html",
"http://www.ietf.org/mail-archive/web/tls/current/msg03928.html",
"http://www.ietf.org/mail-archive/web/tls/current/msg03948.html",
"http://www.ingate.com/Relnote.php?ver=481",
"http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995",
"http://www.kb.cert.org/vuls/id/120541",
"http://www.links.org/?p=780",
"http://www.links.org/?p=786",
"http://www.links.org/?p=789",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:076",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:084",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
"http://www.mozilla.org/security/announce/2010/mfsa2010-22.html",
"http://www.openoffice.org/security/cves/CVE-2009-3555.html",
"http://www.openssl.org/news/secadv_20091111.txt",
"http://www.openwall.com/lists/oss-security/2009/11/05/3",
"http://www.openwall.com/lists/oss-security/2009/11/05/5",
"http://www.openwall.com/lists/oss-security/2009/11/06/3",
"http://www.openwall.com/lists/oss-security/2009/11/07/3",
"http://www.openwall.com/lists/oss-security/2009/11/20/1",
"http://www.openwall.com/lists/oss-security/2009/11/23/10",
"http://www.opera.com/docs/changelogs/unix/1060/",
"http://www.opera.com/support/search/view/944/",
"http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
"http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html",
"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c",
"http://www.redhat.com/support/errata/RHSA-2010-0119.html",
"http://www.redhat.com/support/errata/RHSA-2010-0130.html",
"http://www.redhat.com/support/errata/RHSA-2010-0155.html",
"http://www.redhat.com/support/errata/RHSA-2010-0165.html",
"http://www.redhat.com/support/errata/RHSA-2010-0167.html",
"http://www.redhat.com/support/errata/RHSA-2010-0337.html",
"http://www.redhat.com/support/errata/RHSA-2010-0338.html",
"http://www.redhat.com/support/errata/RHSA-2010-0339.html",
"http://www.redhat.com/support/errata/RHSA-2010-0768.html",
"http://www.redhat.com/support/errata/RHSA-2010-0770.html",
"http://www.redhat.com/support/errata/RHSA-2010-0786.html",
"http://www.redhat.com/support/errata/RHSA-2010-0807.html",
"http://www.redhat.com/support/errata/RHSA-2010-0865.html",
"http://www.redhat.com/support/errata/RHSA-2010-0986.html",
"http://www.redhat.com/support/errata/RHSA-2010-0987.html",
"http://www.redhat.com/support/errata/RHSA-2011-0880.html",
"http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html",
"http://www.securityfocus.com/archive/1/507952/100/0/threaded",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"http://www.securityfocus.com/archive/1/508130/100/0/threaded",
"http://www.securityfocus.com/archive/1/515055/100/0/threaded",
"http://www.securityfocus.com/archive/1/516397/100/0/threaded",
"http://www.securityfocus.com/archive/1/522176",
"http://www.securityfocus.com/bid/36935",
"http://www.securitytracker.com/id?1023163",
"http://www.securitytracker.com/id?1023204",
"http://www.securitytracker.com/id?1023205",
"http://www.securitytracker.com/id?1023206",
"http://www.securitytracker.com/id?1023207",
"http://www.securitytracker.com/id?1023208",
"http://www.securitytracker.com/id?1023209",
"http://www.securitytracker.com/id?1023210",
"http://www.securitytracker.com/id?1023211",
"http://www.securitytracker.com/id?1023212",
"http://www.securitytracker.com/id?1023213",
"http://www.securitytracker.com/id?1023214",
"http://www.securitytracker.com/id?1023215",
"http://www.securitytracker.com/id?1023216",
"http://www.securitytracker.com/id?1023217",
"http://www.securitytracker.com/id?1023218",
"http://www.securitytracker.com/id?1023219",
"http://www.securitytracker.com/id?1023224",
"http://www.securitytracker.com/id?1023243",
"http://www.securitytracker.com/id?1023270",
"http://www.securitytracker.com/id?1023271",
"http://www.securitytracker.com/id?1023272",
"http://www.securitytracker.com/id?1023273",
"http://www.securitytracker.com/id?1023274",
"http://www.securitytracker.com/id?1023275",
"http://www.securitytracker.com/id?1023411",
"http://www.securitytracker.com/id?1023426",
"http://www.securitytracker.com/id?1023427",
"http://www.securitytracker.com/id?1023428",
"http://www.securitytracker.com/id?1024789",
"http://www.tombom.co.uk/blog/?p=85",
"http://www.ubuntu.com/usn/USN-1010-1",
"http://www.ubuntu.com/usn/USN-927-1",
"http://www.ubuntu.com/usn/USN-927-4",
"http://www.ubuntu.com/usn/USN-927-5",
"http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
"http://www.us-cert.gov/cas/techalerts/TA10-287A.html",
"http://www.vmware.com/security/advisories/VMSA-2010-0019.html",
"http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
"http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
"http://www.vupen.com/english/advisories/2009/3164",
"http://www.vupen.com/english/advisories/2009/3165",
"http://www.vupen.com/english/advisories/2009/3205",
"http://www.vupen.com/english/advisories/2009/3220",
"http://www.vupen.com/english/advisories/2009/3310",
"http://www.vupen.com/english/advisories/2009/3313",
"http://www.vupen.com/english/advisories/2009/3353",
"http://www.vupen.com/english/advisories/2009/3354",
"http://www.vupen.com/english/advisories/2009/3484",
"http://www.vupen.com/english/advisories/2009/3521",
"http://www.vupen.com/english/advisories/2009/3587",
"http://www.vupen.com/english/advisories/2010/0086",
"http://www.vupen.com/english/advisories/2010/0173",
"http://www.vupen.com/english/advisories/2010/0748",
"http://www.vupen.com/english/advisories/2010/0848",
"http://www.vupen.com/english/advisories/2010/0916",
"http://www.vupen.com/english/advisories/2010/0933",
"http://www.vupen.com/english/advisories/2010/0982",
"http://www.vupen.com/english/advisories/2010/0994",
"http://www.vupen.com/english/advisories/2010/1054",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2010/1191",
"http://www.vupen.com/english/advisories/2010/1350",
"http://www.vupen.com/english/advisories/2010/1639",
"http://www.vupen.com/english/advisories/2010/1673",
"http://www.vupen.com/english/advisories/2010/1793",
"http://www.vupen.com/english/advisories/2010/2010",
"http://www.vupen.com/english/advisories/2010/2745",
"http://www.vupen.com/english/advisories/2010/3069",
"http://www.vupen.com/english/advisories/2010/3086",
"http://www.vupen.com/english/advisories/2010/3126",
"http://www.vupen.com/english/advisories/2011/0032",
"http://www.vupen.com/english/advisories/2011/0033",
"http://www.vupen.com/english/advisories/2011/0086",
"http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html",
"https://bugzilla.mozilla.org/show_bug.cgi?id=526689",
"https://bugzilla.mozilla.org/show_bug.cgi?id=545755",
"https://bugzilla.redhat.com/show_bug.cgi?id=533125",
"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/54158",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888",
"https://kb.bluecoat.com/index?page=content&id=SA50",
"https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535",
"https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html",
"https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html",
"http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html",
"http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html",
"http://blogs.iss.net/archive/sslmitmiscsrf.html",
"http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during",
"http://clicky.me/tlsvuln",
"http://extendedsubset.com/?p=8",
"http://extendedsubset.com/Renegotiating_TLS.pdf",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041",
"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751",
"http://kbase.redhat.com/faq/docs/DOC-20491",
"http://lists.apple.com/archives/security-announce/2010//May/msg00001.html",
"http://lists.apple.com/archives/security-announce/2010//May/msg00002.html",
"http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html",
"http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html",
"http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2",
"http://marc.info/?l=bugtraq&m=126150535619567&w=2",
"http://marc.info/?l=bugtraq&m=127128920008563&w=2",
"http://marc.info/?l=bugtraq&m=127419602507642&w=2",
"http://marc.info/?l=bugtraq&m=127557596201693&w=2",
"http://marc.info/?l=bugtraq&m=130497311408250&w=2",
"http://marc.info/?l=bugtraq&m=132077688910227&w=2",
"http://marc.info/?l=bugtraq&m=133469267822771&w=2",
"http://marc.info/?l=bugtraq&m=134254866602253&w=2",
"http://marc.info/?l=bugtraq&m=142660345230545&w=2",
"http://marc.info/?l=cryptography&m=125752275331877&w=2",
"http://openbsd.org/errata45.html#010_openssl",
"http://openbsd.org/errata46.html#004_openssl",
"http://osvdb.org/60521",
"http://osvdb.org/60972",
"http://osvdb.org/62210",
"http://osvdb.org/65202",
"http://seclists.org/fulldisclosure/2009/Nov/139",
"http://secunia.com/advisories/37291",
"http://secunia.com/advisories/37292",
"http://secunia.com/advisories/37320",
"http://secunia.com/advisories/37383",
"http://secunia.com/advisories/37399",
"http://secunia.com/advisories/37453",
"http://secunia.com/advisories/37501",
"http://secunia.com/advisories/37504",
"http://secunia.com/advisories/37604",
"http://secunia.com/advisories/37640",
"http://secunia.com/advisories/37656",
"http://secunia.com/advisories/37675",
"http://secunia.com/advisories/37859",
"http://secunia.com/advisories/38003",
"http://secunia.com/advisories/38020",
"http://secunia.com/advisories/38056",
"http://secunia.com/advisories/38241",
"http://secunia.com/advisories/38484",
"http://secunia.com/advisories/38687",
"http://secunia.com/advisories/38781",
"http://secunia.com/advisories/39127",
"http://secunia.com/advisories/39136",
"http://secunia.com/advisories/39242",
"http://secunia.com/advisories/39243",
"http://secunia.com/advisories/39278",
"http://secunia.com/advisories/39292",
"http://secunia.com/advisories/39317",
"http://secunia.com/advisories/39461",
"http://secunia.com/advisories/39500",
"http://secunia.com/advisories/39628",
"http://secunia.com/advisories/39632",
"http://secunia.com/advisories/39713",
"http://secunia.com/advisories/39819",
"http://secunia.com/advisories/40070",
"http://secunia.com/advisories/40545",
"http://secunia.com/advisories/40747",
"http://secunia.com/advisories/40866",
"http://secunia.com/advisories/41480",
"http://secunia.com/advisories/41490",
"http://secunia.com/advisories/41818",
"http://secunia.com/advisories/41967",
"http://secunia.com/advisories/41972",
"http://secunia.com/advisories/42377",
"http://secunia.com/advisories/42379",
"http://secunia.com/advisories/42467",
"http://secunia.com/advisories/42724",
"http://secunia.com/advisories/42733",
"http://secunia.com/advisories/42808",
"http://secunia.com/advisories/42811",
"http://secunia.com/advisories/42816",
"http://secunia.com/advisories/43308",
"http://secunia.com/advisories/44183",
"http://secunia.com/advisories/44954",
"http://secunia.com/advisories/48577",
"http://security.gentoo.org/glsa/glsa-200912-01.xml",
"http://security.gentoo.org/glsa/glsa-201203-22.xml",
"http://security.gentoo.org/glsa/glsa-201406-32.xml",
"http://securitytracker.com/id?1023148",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446",
"http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1",
"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1",
"http://support.apple.com/kb/HT4004",
"http://support.apple.com/kb/HT4170",
"http://support.apple.com/kb/HT4171",
"http://support.avaya.com/css/P8/documents/100070150",
"http://support.avaya.com/css/P8/documents/100081611",
"http://support.avaya.com/css/P8/documents/100114315",
"http://support.avaya.com/css/P8/documents/100114327",
"http://support.citrix.com/article/CTX123359",
"http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES",
"http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released",
"http://sysoev.ru/nginx/patch.cve-2009-3555.txt",
"http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html",
"http://ubuntu.com/usn/usn-923-1",
"http://wiki.rpath.com/Advisories:rPSA-2009-0155",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054",
"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www-01.ibm.com/support/docview.wss?uid=swg21426108",
"http://www-01.ibm.com/support/docview.wss?uid=swg21432298",
"http://www-01.ibm.com/support/docview.wss?uid=swg24006386",
"http://www-01.ibm.com/support/docview.wss?uid=swg24025312",
"http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only",
"http://www.arubanetworks.com/support/alerts/aid-020810.txt",
"http://www.betanews.com/article/1257452450",
"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml",
"http://www.debian.org/security/2009/dsa-1934",
"http://www.debian.org/security/2011/dsa-2141",
"http://www.debian.org/security/2015/dsa-3253",
"http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html",
"http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html",
"http://www.ietf.org/mail-archive/web/tls/current/msg03928.html",
"http://www.ietf.org/mail-archive/web/tls/current/msg03948.html",
"http://www.ingate.com/Relnote.php?ver=481",
"http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995",
"http://www.kb.cert.org/vuls/id/120541",
"http://www.links.org/?p=780",
"http://www.links.org/?p=786",
"http://www.links.org/?p=789",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:076",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:084",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
"http://www.mozilla.org/security/announce/2010/mfsa2010-22.html",
"http://www.openoffice.org/security/cves/CVE-2009-3555.html",
"http://www.openssl.org/news/secadv_20091111.txt",
"http://www.openwall.com/lists/oss-security/2009/11/05/3",
"http://www.openwall.com/lists/oss-security/2009/11/05/5",
"http://www.openwall.com/lists/oss-security/2009/11/06/3",
"http://www.openwall.com/lists/oss-security/2009/11/07/3",
"http://www.openwall.com/lists/oss-security/2009/11/20/1",
"http://www.openwall.com/lists/oss-security/2009/11/23/10",
"http://www.opera.com/docs/changelogs/unix/1060/",
"http://www.opera.com/support/search/view/944/",
"http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
"http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html",
"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c",
"http://www.redhat.com/support/errata/RHSA-2010-0119.html",
"http://www.redhat.com/support/errata/RHSA-2010-0130.html",
"http://www.redhat.com/support/errata/RHSA-2010-0155.html",
"http://www.redhat.com/support/errata/RHSA-2010-0165.html",
"http://www.redhat.com/support/errata/RHSA-2010-0167.html",
"http://www.redhat.com/support/errata/RHSA-2010-0337.html",
"http://www.redhat.com/support/errata/RHSA-2010-0338.html",
"http://www.redhat.com/support/errata/RHSA-2010-0339.html",
"http://www.redhat.com/support/errata/RHSA-2010-0768.html",
"http://www.redhat.com/support/errata/RHSA-2010-0770.html",
"http://www.redhat.com/support/errata/RHSA-2010-0786.html",
"http://www.redhat.com/support/errata/RHSA-2010-0807.html",
"http://www.redhat.com/support/errata/RHSA-2010-0865.html",
"http://www.redhat.com/support/errata/RHSA-2010-0986.html",
"http://www.redhat.com/support/errata/RHSA-2010-0987.html",
"http://www.redhat.com/support/errata/RHSA-2011-0880.html",
"http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html",
"http://www.securityfocus.com/archive/1/507952/100/0/threaded",
"http://www.securityfocus.com/archive/1/508075/100/0/threaded",
"http://www.securityfocus.com/archive/1/508130/100/0/threaded",
"http://www.securityfocus.com/archive/1/515055/100/0/threaded",
"http://www.securityfocus.com/archive/1/516397/100/0/threaded",
"http://www.securityfocus.com/archive/1/522176",
"http://www.securityfocus.com/bid/36935",
"http://www.securitytracker.com/id?1023163",
"http://www.securitytracker.com/id?1023204",
"http://www.securitytracker.com/id?1023205",
"http://www.securitytracker.com/id?1023206",
"http://www.securitytracker.com/id?1023207",
"http://www.securitytracker.com/id?1023208",
"http://www.securitytracker.com/id?1023209",
"http://www.securitytracker.com/id?1023210",
"http://www.securitytracker.com/id?1023211",
"http://www.securitytracker.com/id?1023212",
"http://www.securitytracker.com/id?1023213",
"http://www.securitytracker.com/id?1023214",
"http://www.securitytracker.com/id?1023215",
"http://www.securitytracker.com/id?1023216",
"http://www.securitytracker.com/id?1023217",
"http://www.securitytracker.com/id?1023218",
"http://www.securitytracker.com/id?1023219",
"http://www.securitytracker.com/id?1023224",
"http://www.securitytracker.com/id?1023243",
"http://www.securitytracker.com/id?1023270",
"http://www.securitytracker.com/id?1023271",
"http://www.securitytracker.com/id?1023272",
"http://www.securitytracker.com/id?1023273",
"http://www.securitytracker.com/id?1023274",
"http://www.securitytracker.com/id?1023275",
"http://www.securitytracker.com/id?1023411",
"http://www.securitytracker.com/id?1023426",
"http://www.securitytracker.com/id?1023427",
"http://www.securitytracker.com/id?1023428",
"http://www.securitytracker.com/id?1024789",
"http://www.tombom.co.uk/blog/?p=85",
"http://www.ubuntu.com/usn/USN-1010-1",
"http://www.ubuntu.com/usn/USN-927-1",
"http://www.ubuntu.com/usn/USN-927-4",
"http://www.ubuntu.com/usn/USN-927-5",
"http://www.us-cert.gov/cas/techalerts/TA10-222A.html",
"http://www.us-cert.gov/cas/techalerts/TA10-287A.html",
"http://www.vmware.com/security/advisories/VMSA-2010-0019.html",
"http://www.vmware.com/security/advisories/VMSA-2011-0003.html",
"http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html",
"http://www.vupen.com/english/advisories/2009/3164",
"http://www.vupen.com/english/advisories/2009/3165",
"http://www.vupen.com/english/advisories/2009/3205",
"http://www.vupen.com/english/advisories/2009/3220",
"http://www.vupen.com/english/advisories/2009/3310",
"http://www.vupen.com/english/advisories/2009/3313",
"http://www.vupen.com/english/advisories/2009/3353",
"http://www.vupen.com/english/advisories/2009/3354",
"http://www.vupen.com/english/advisories/2009/3484",
"http://www.vupen.com/english/advisories/2009/3521",
"http://www.vupen.com/english/advisories/2009/3587",
"http://www.vupen.com/english/advisories/2010/0086",
"http://www.vupen.com/english/advisories/2010/0173",
"http://www.vupen.com/english/advisories/2010/0748",
"http://www.vupen.com/english/advisories/2010/0848",
"http://www.vupen.com/english/advisories/2010/0916",
"http://www.vupen.com/english/advisories/2010/0933",
"http://www.vupen.com/english/advisories/2010/0982",
"http://www.vupen.com/english/advisories/2010/0994",
"http://www.vupen.com/english/advisories/2010/1054",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2010/1191",
"http://www.vupen.com/english/advisories/2010/1350",
"http://www.vupen.com/english/advisories/2010/1639",
"http://www.vupen.com/english/advisories/2010/1673",
"http://www.vupen.com/english/advisories/2010/1793",
"http://www.vupen.com/english/advisories/2010/2010",
"http://www.vupen.com/english/advisories/2010/2745",
"http://www.vupen.com/english/advisories/2010/3069",
"http://www.vupen.com/english/advisories/2010/3086",
"http://www.vupen.com/english/advisories/2010/3126",
"http://www.vupen.com/english/advisories/2011/0032",
"http://www.vupen.com/english/advisories/2011/0033",
"http://www.vupen.com/english/advisories/2011/0086",
"http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html",
"https://bugzilla.mozilla.org/show_bug.cgi?id=526689",
"https://bugzilla.mozilla.org/show_bug.cgi?id=545755",
"https://bugzilla.redhat.com/show_bug.cgi?id=533125",
"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/54158",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888",
"https://kb.bluecoat.com/index?page=content&id=SA50",
"https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535",
"https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html",
"https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html"
],
"score": 5.8,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
"weakness": "CWE-295"
},
"CVE-2009-3560": {
"id": "CVE-2009-3560",
"references": [
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165",
"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
"http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/37537",
"http://secunia.com/advisories/38231",
"http://secunia.com/advisories/38794",
"http://secunia.com/advisories/38832",
"http://secunia.com/advisories/38834",
"http://secunia.com/advisories/39478",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/43300",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
"http://www.debian.org/security/2009/dsa-1953",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:316",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.securityfocus.com/bid/37203",
"http://www.securitytracker.com/id?1023278",
"http://www.ubuntu.com/usn/USN-890-1",
"http://www.ubuntu.com/usn/USN-890-6",
"http://www.vupen.com/english/advisories/2010/0528",
"http://www.vupen.com/english/advisories/2010/0896",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2011/0359",
"https://bugzilla.redhat.com/show_bug.cgi?id=533174",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10613",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12942",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6883",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00394.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165",
"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
"http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/37537",
"http://secunia.com/advisories/38231",
"http://secunia.com/advisories/38794",
"http://secunia.com/advisories/38832",
"http://secunia.com/advisories/38834",
"http://secunia.com/advisories/39478",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/43300",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
"http://www.debian.org/security/2009/dsa-1953",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:316",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.securityfocus.com/bid/37203",
"http://www.securitytracker.com/id?1023278",
"http://www.ubuntu.com/usn/USN-890-1",
"http://www.ubuntu.com/usn/USN-890-6",
"http://www.vupen.com/english/advisories/2010/0528",
"http://www.vupen.com/english/advisories/2010/0896",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2011/0359",
"https://bugzilla.redhat.com/show_bug.cgi?id=533174",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10613",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12942",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6883",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00394.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-119"
},
"CVE-2009-3720": {
"id": "CVE-2009-3720",
"references": [
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
"http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/37324",
"http://secunia.com/advisories/37537",
"http://secunia.com/advisories/37925",
"http://secunia.com/advisories/38050",
"http://secunia.com/advisories/38231",
"http://secunia.com/advisories/38794",
"http://secunia.com/advisories/38832",
"http://secunia.com/advisories/38834",
"http://secunia.com/advisories/39478",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/42326",
"http://secunia.com/advisories/42338",
"http://secunia.com/advisories/43300",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
"http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
"http://svn.python.org/view?view=rev&revision=74429",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:211",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:212",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:215",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:216",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:217",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:218",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:219",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:220",
"http://www.openwall.com/lists/oss-security/2009/08/21/2",
"http://www.openwall.com/lists/oss-security/2009/08/26/3",
"http://www.openwall.com/lists/oss-security/2009/08/26/4",
"http://www.openwall.com/lists/oss-security/2009/08/27/6",
"http://www.openwall.com/lists/oss-security/2009/09/06/1",
"http://www.openwall.com/lists/oss-security/2009/10/22/5",
"http://www.openwall.com/lists/oss-security/2009/10/22/9",
"http://www.openwall.com/lists/oss-security/2009/10/23/2",
"http://www.openwall.com/lists/oss-security/2009/10/23/6",
"http://www.openwall.com/lists/oss-security/2009/10/26/3",
"http://www.openwall.com/lists/oss-security/2009/10/28/3",
"http://www.redhat.com/support/errata/RHSA-2010-0002.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.securitytracker.com/id?1023160",
"http://www.ubuntu.com/usn/USN-890-1",
"http://www.ubuntu.com/usn/USN-890-6",
"http://www.vupen.com/english/advisories/2010/0528",
"http://www.vupen.com/english/advisories/2010/0896",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2010/3035",
"http://www.vupen.com/english/advisories/2010/3053",
"http://www.vupen.com/english/advisories/2010/3061",
"http://www.vupen.com/english/advisories/2011/0359",
"https://bugs.gentoo.org/show_bug.cgi?id=280615",
"https://bugzilla.redhat.com/show_bug.cgi?id=531697",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11019",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12719",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7112",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.html",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch",
"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html",
"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000082.html",
"http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/37324",
"http://secunia.com/advisories/37537",
"http://secunia.com/advisories/37925",
"http://secunia.com/advisories/38050",
"http://secunia.com/advisories/38231",
"http://secunia.com/advisories/38794",
"http://secunia.com/advisories/38832",
"http://secunia.com/advisories/38834",
"http://secunia.com/advisories/39478",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/42326",
"http://secunia.com/advisories/42338",
"http://secunia.com/advisories/43300",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
"http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127",
"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1",
"http://svn.python.org/view?view=rev&revision=74429",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:211",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:212",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:215",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:216",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:217",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:218",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:219",
"http://www.mandriva.com/security/advisories?name=MDVSA-2009:220",
"http://www.openwall.com/lists/oss-security/2009/08/21/2",
"http://www.openwall.com/lists/oss-security/2009/08/26/3",
"http://www.openwall.com/lists/oss-security/2009/08/26/4",
"http://www.openwall.com/lists/oss-security/2009/08/27/6",
"http://www.openwall.com/lists/oss-security/2009/09/06/1",
"http://www.openwall.com/lists/oss-security/2009/10/22/5",
"http://www.openwall.com/lists/oss-security/2009/10/22/9",
"http://www.openwall.com/lists/oss-security/2009/10/23/2",
"http://www.openwall.com/lists/oss-security/2009/10/23/6",
"http://www.openwall.com/lists/oss-security/2009/10/26/3",
"http://www.openwall.com/lists/oss-security/2009/10/28/3",
"http://www.redhat.com/support/errata/RHSA-2010-0002.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.securitytracker.com/id?1023160",
"http://www.ubuntu.com/usn/USN-890-1",
"http://www.ubuntu.com/usn/USN-890-6",
"http://www.vupen.com/english/advisories/2010/0528",
"http://www.vupen.com/english/advisories/2010/0896",
"http://www.vupen.com/english/advisories/2010/1107",
"http://www.vupen.com/english/advisories/2010/3035",
"http://www.vupen.com/english/advisories/2010/3053",
"http://www.vupen.com/english/advisories/2010/3061",
"http://www.vupen.com/english/advisories/2011/0359",
"https://bugs.gentoo.org/show_bug.cgi?id=280615",
"https://bugzilla.redhat.com/show_bug.cgi?id=531697",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11019",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12719",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7112",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html",
"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.html"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2010-0408": {
"id": "CVE-2010-0408",
"references": [
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://secunia.com/advisories/39100",
"http://secunia.com/advisories/39501",
"http://secunia.com/advisories/39628",
"http://secunia.com/advisories/39632",
"http://secunia.com/advisories/39656",
"http://secunia.com/advisories/40096",
"http://support.apple.com/kb/HT4435",
"http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_ajp.c?r1=917876&r2=917875&pathrev=917876",
"http://svn.apache.org/viewvc?view=revision&revision=917876",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
"http://www.debian.org/security/2010/dsa-2035",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:053",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html",
"http://www.redhat.com/support/errata/RHSA-2010-0168.html",
"http://www.securityfocus.com/bid/38491",
"http://www.vupen.com/english/advisories/2010/0911",
"http://www.vupen.com/english/advisories/2010/0994",
"http://www.vupen.com/english/advisories/2010/1001",
"http://www.vupen.com/english/advisories/2010/1057",
"http://www.vupen.com/english/advisories/2010/1411",
"https://bugzilla.redhat.com/show_bug.cgi?id=569905",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8619",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9935"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-Other"
},
"CVE-2010-0425": {
"id": "CVE-2010-0425",
"references": [
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
"http://secunia.com/advisories/38978",
"http://secunia.com/advisories/39628",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870",
"http://svn.apache.org/viewvc?view=revision&revision=917870",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www.kb.cert.org/vuls/id/280613",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.securityfocus.com/bid/38494",
"http://www.securitytracker.com/id?1023701",
"http://www.senseofsecurity.com.au/advisories/SOS-10-002",
"http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
"http://www.vupen.com/english/advisories/2010/0634",
"http://www.vupen.com/english/advisories/2010/0994",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/56624",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8439",
"https://www.exploit-db.com/exploits/11650",
"http://httpd.apache.org/security/vulnerabilities_20.html",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
"http://secunia.com/advisories/38978",
"http://secunia.com/advisories/39628",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=917870&r2=917869&pathrev=917870",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/win32/mod_isapi.c?r1=917870&r2=917869&pathrev=917870",
"http://svn.apache.org/viewvc?view=revision&revision=917870",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM09447",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www.kb.cert.org/vuls/id/280613",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.securityfocus.com/bid/38494",
"http://www.securitytracker.com/id?1023701",
"http://www.senseofsecurity.com.au/advisories/SOS-10-002",
"http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
"http://www.vupen.com/english/advisories/2010/0634",
"http://www.vupen.com/english/advisories/2010/0994",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/56624",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8439",
"https://www.exploit-db.com/exploits/11650"
],
"score": 10,
"services": [
"443/http"
],
"severity": "high",
"summary": "modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and \"orphaned callback pointers.\"",
"vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2010-0434": {
"id": "CVE-2010-0434",
"references": [
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://secunia.com/advisories/39100",
"http://secunia.com/advisories/39115",
"http://secunia.com/advisories/39501",
"http://secunia.com/advisories/39628",
"http://secunia.com/advisories/39632",
"http://secunia.com/advisories/39656",
"http://secunia.com/advisories/40096",
"http://support.apple.com/kb/HT4435",
"http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h",
"http://svn.apache.org/viewvc?view=revision&revision=917867",
"http://svn.apache.org/viewvc?view=revision&revision=918427",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
"http://www.debian.org/security/2010/dsa-2035",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2010-0168.html",
"http://www.redhat.com/support/errata/RHSA-2010-0175.html",
"http://www.securityfocus.com/bid/38494",
"http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
"http://www.vupen.com/english/advisories/2010/0911",
"http://www.vupen.com/english/advisories/2010/0994",
"http://www.vupen.com/english/advisories/2010/1001",
"http://www.vupen.com/english/advisories/2010/1057",
"http://www.vupen.com/english/advisories/2010/1411",
"https://bugzilla.redhat.com/show_bug.cgi?id=570171",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/56625",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=48359",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html",
"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html",
"http://lists.vmware.com/pipermail/security-announce/2010/000105.html",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://marc.info/?l=bugtraq&m=127557640302499&w=2",
"http://secunia.com/advisories/39100",
"http://secunia.com/advisories/39115",
"http://secunia.com/advisories/39501",
"http://secunia.com/advisories/39628",
"http://secunia.com/advisories/39632",
"http://secunia.com/advisories/39656",
"http://secunia.com/advisories/40096",
"http://support.apple.com/kb/HT4435",
"http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/protocol.c?r1=917617&r2=917867&pathrev=917867&diff_format=h",
"http://svn.apache.org/viewvc?view=revision&revision=917867",
"http://svn.apache.org/viewvc?view=revision&revision=918427",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829",
"http://www.debian.org/security/2010/dsa-2035",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2010-0168.html",
"http://www.redhat.com/support/errata/RHSA-2010-0175.html",
"http://www.securityfocus.com/bid/38494",
"http://www.vmware.com/security/advisories/VMSA-2010-0014.html",
"http://www.vupen.com/english/advisories/2010/0911",
"http://www.vupen.com/english/advisories/2010/0994",
"http://www.vupen.com/english/advisories/2010/1001",
"http://www.vupen.com/english/advisories/2010/1057",
"http://www.vupen.com/english/advisories/2010/1411",
"https://bugzilla.redhat.com/show_bug.cgi?id=570171",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/56625",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=48359",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.",
"vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"weakness": "CWE-200"
},
"CVE-2010-1452": {
"id": "CVE-2010-1452",
"references": [
"http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
"http://marc.info/?l=apache-announce&m=128009718610929&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/42367",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.467395",
"http://support.apple.com/kb/HT4581",
"http://ubuntu.com/usn/usn-1021-1",
"http://www.redhat.com/support/errata/RHSA-2010-0659.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"http://www.vupen.com/english/advisories/2010/2218",
"http://www.vupen.com/english/advisories/2010/3064",
"http://www.vupen.com/english/advisories/2011/0291",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=49246",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11683",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12341",
"http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
"http://marc.info/?l=apache-announce&m=128009718610929&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=129190899612998&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://marc.info/?l=bugtraq&m=133355494609819&w=2",
"http://secunia.com/advisories/42367",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.467395",
"http://support.apple.com/kb/HT4581",
"http://ubuntu.com/usn/usn-1021-1",
"http://www.redhat.com/support/errata/RHSA-2010-0659.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"http://www.vupen.com/english/advisories/2010/2218",
"http://www.vupen.com/english/advisories/2010/3064",
"http://www.vupen.com/english/advisories/2011/0291",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=49246",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11683",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12341"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-Other"
},
"CVE-2010-1623": {
"id": "CVE-2010-1623",
"references": [
"http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/42015",
"http://secunia.com/advisories/42361",
"http://secunia.com/advisories/42367",
"http://secunia.com/advisories/42403",
"http://secunia.com/advisories/42537",
"http://secunia.com/advisories/43211",
"http://secunia.com/advisories/43285",
"http://security-tracker.debian.org/tracker/CVE-2010-1623",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828",
"http://svn.apache.org/viewvc?view=revision&revision=1003492",
"http://svn.apache.org/viewvc?view=revision&revision=1003493",
"http://svn.apache.org/viewvc?view=revision&revision=1003494",
"http://svn.apache.org/viewvc?view=revision&revision=1003495",
"http://svn.apache.org/viewvc?view=revision&revision=1003626",
"http://ubuntu.com/usn/usn-1021-1",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:192",
"http://www.redhat.com/support/errata/RHSA-2010-0950.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"http://www.securityfocus.com/bid/43673",
"http://www.ubuntu.com/usn/USN-1022-1",
"http://www.vupen.com/english/advisories/2010/2556",
"http://www.vupen.com/english/advisories/2010/2557",
"http://www.vupen.com/english/advisories/2010/2806",
"http://www.vupen.com/english/advisories/2010/3064",
"http://www.vupen.com/english/advisories/2010/3065",
"http://www.vupen.com/english/advisories/2010/3074",
"http://www.vupen.com/english/advisories/2011/0358",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800",
"http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://marc.info/?l=bugtraq&m=130168502603566&w=2",
"http://secunia.com/advisories/41701",
"http://secunia.com/advisories/42015",
"http://secunia.com/advisories/42361",
"http://secunia.com/advisories/42367",
"http://secunia.com/advisories/42403",
"http://secunia.com/advisories/42537",
"http://secunia.com/advisories/43211",
"http://secunia.com/advisories/43285",
"http://security-tracker.debian.org/tracker/CVE-2010-1623",
"http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828",
"http://svn.apache.org/viewvc?view=revision&revision=1003492",
"http://svn.apache.org/viewvc?view=revision&revision=1003493",
"http://svn.apache.org/viewvc?view=revision&revision=1003494",
"http://svn.apache.org/viewvc?view=revision&revision=1003495",
"http://svn.apache.org/viewvc?view=revision&revision=1003626",
"http://ubuntu.com/usn/usn-1021-1",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
"http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601",
"http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3",
"http://www.mandriva.com/security/advisories?name=MDVSA-2010:192",
"http://www.redhat.com/support/errata/RHSA-2010-0950.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"http://www.securityfocus.com/bid/43673",
"http://www.ubuntu.com/usn/USN-1022-1",
"http://www.vupen.com/english/advisories/2010/2556",
"http://www.vupen.com/english/advisories/2010/2557",
"http://www.vupen.com/english/advisories/2010/2806",
"http://www.vupen.com/english/advisories/2010/3064",
"http://www.vupen.com/english/advisories/2010/3065",
"http://www.vupen.com/english/advisories/2010/3074",
"http://www.vupen.com/english/advisories/2011/0358",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-119"
},
"CVE-2011-0419": {
"id": "CVE-2011-0419",
"references": [
"http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22",
"http://cxib.net/stuff/apache.fnmatch.phps",
"http://cxib.net/stuff/apr_fnmatch.txts",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://secunia.com/advisories/44490",
"http://secunia.com/advisories/44564",
"http://secunia.com/advisories/44574",
"http://secunia.com/advisories/48308",
"http://securityreason.com/achievement_securityalert/98",
"http://securityreason.com/securityalert/8246",
"http://securitytracker.com/id?1025527",
"http://support.apple.com/kb/HT5002",
"http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902",
"http://svn.apache.org/viewvc?view=revision&revision=1098188",
"http://svn.apache.org/viewvc?view=revision&revision=1098799",
"http://www.apache.org/dist/apr/Announcement1.x.html",
"http://www.apache.org/dist/apr/CHANGES-APR-1.4",
"http://www.apache.org/dist/httpd/Announcement2.2.html",
"http://www.debian.org/security/2011/dsa-2237",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23960.html",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23961.html",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23976.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:084",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fnmatch.c#rev1.15",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2011-0507.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"https://bugzilla.redhat.com/show_bug.cgi?id=703390",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804",
"http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22",
"http://cxib.net/stuff/apache.fnmatch.phps",
"http://cxib.net/stuff/apr_fnmatch.txts",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://secunia.com/advisories/44490",
"http://secunia.com/advisories/44564",
"http://secunia.com/advisories/44574",
"http://secunia.com/advisories/48308",
"http://securityreason.com/achievement_securityalert/98",
"http://securityreason.com/securityalert/8246",
"http://securitytracker.com/id?1025527",
"http://support.apple.com/kb/HT5002",
"http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/strings/apr_fnmatch.c?r1=731029&r2=1098902",
"http://svn.apache.org/viewvc?view=revision&revision=1098188",
"http://svn.apache.org/viewvc?view=revision&revision=1098799",
"http://www.apache.org/dist/apr/Announcement1.x.html",
"http://www.apache.org/dist/apr/CHANGES-APR-1.4",
"http://www.apache.org/dist/httpd/Announcement2.2.html",
"http://www.debian.org/security/2011/dsa-2237",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23960.html",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23961.html",
"http://www.mail-archive.com/dev%40apr.apache.org/msg23976.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:084",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fnmatch.c#rev1.15",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.redhat.com/support/errata/RHSA-2011-0507.html",
"http://www.redhat.com/support/errata/RHSA-2011-0896.html",
"http://www.redhat.com/support/errata/RHSA-2011-0897.html",
"https://bugzilla.redhat.com/show_bug.cgi?id=703390",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"weakness": "CWE-770"
},
"CVE-2011-3192": {
"id": "CVE-2011-3192",
"references": [
"http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html",
"http://blogs.oracle.com/security/entry/security_alert_for_cve_2011",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD%40minotaur.apache.org%3e",
"http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g%40mail.gmail.com%3e",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=133477473521382&w=2",
"http://marc.info/?l=bugtraq&m=133477473521382&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://osvdb.org/74721",
"http://seclists.org/fulldisclosure/2011/Aug/175",
"http://secunia.com/advisories/45606",
"http://secunia.com/advisories/45937",
"http://secunia.com/advisories/46000",
"http://secunia.com/advisories/46125",
"http://secunia.com/advisories/46126",
"http://securitytracker.com/id?1025960",
"http://support.apple.com/kb/HT5002",
"http://www.apache.org/dist/httpd/Announcement2.2.html",
"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml",
"http://www.exploit-db.com/exploits/17696",
"http://www.gossamer-threads.com/lists/apache/dev/401638",
"http://www.kb.cert.org/vuls/id/405811",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:130",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
"http://www.redhat.com/support/errata/RHSA-2011-1245.html",
"http://www.redhat.com/support/errata/RHSA-2011-1294.html",
"http://www.redhat.com/support/errata/RHSA-2011-1300.html",
"http://www.redhat.com/support/errata/RHSA-2011-1329.html",
"http://www.redhat.com/support/errata/RHSA-2011-1330.html",
"http://www.redhat.com/support/errata/RHSA-2011-1369.html",
"http://www.securityfocus.com/bid/49303",
"http://www.ubuntu.com/usn/USN-1199-1",
"https://bugzilla.redhat.com/show_bug.cgi?id=732928",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/69396",
"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=51714",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827",
"http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0285.html",
"http://blogs.oracle.com/security/entry/security_alert_for_cve_2011",
"http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00010.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00011.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110824161640.122D387DD%40minotaur.apache.org%3e",
"http://mail-archives.apache.org/mod_mbox/httpd-dev/201108.mbox/%3cCAAPSnn2PO-d-C4nQt_TES2RRWiZr7urefhTKPWBC1b+K1Dqc7g%40mail.gmail.com%3e",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131551295528105&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=131731002122529&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=132033751509019&w=2",
"http://marc.info/?l=bugtraq&m=133477473521382&w=2",
"http://marc.info/?l=bugtraq&m=133477473521382&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://osvdb.org/74721",
"http://seclists.org/fulldisclosure/2011/Aug/175",
"http://secunia.com/advisories/45606",
"http://secunia.com/advisories/45937",
"http://secunia.com/advisories/46000",
"http://secunia.com/advisories/46125",
"http://secunia.com/advisories/46126",
"http://securitytracker.com/id?1025960",
"http://support.apple.com/kb/HT5002",
"http://www.apache.org/dist/httpd/Announcement2.2.html",
"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b90d73.shtml",
"http://www.exploit-db.com/exploits/17696",
"http://www.gossamer-threads.com/lists/apache/dev/401638",
"http://www.kb.cert.org/vuls/id/405811",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:130",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/alert-cve-2011-3192-485304.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2011-330135.html",
"http://www.redhat.com/support/errata/RHSA-2011-1245.html",
"http://www.redhat.com/support/errata/RHSA-2011-1294.html",
"http://www.redhat.com/support/errata/RHSA-2011-1300.html",
"http://www.redhat.com/support/errata/RHSA-2011-1329.html",
"http://www.redhat.com/support/errata/RHSA-2011-1330.html",
"http://www.redhat.com/support/errata/RHSA-2011-1369.html",
"http://www.securityfocus.com/bid/49303",
"http://www.ubuntu.com/usn/USN-1199-1",
"https://bugzilla.redhat.com/show_bug.cgi?id=732928",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/69396",
"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
"https://issues.apache.org/bugzilla/show_bug.cgi?id=51714",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14762",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14824",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18827"
],
"score": 7.8,
"services": [
"443/http"
],
"severity": "high",
"summary": "The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"weakness": "CWE-400"
},
"CVE-2011-3368": {
"id": "CVE-2011-3368",
"references": [
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://osvdb.org/76079",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://seclists.org/fulldisclosure/2011/Oct/232",
"http://seclists.org/fulldisclosure/2011/Oct/273",
"http://secunia.com/advisories/46288",
"http://secunia.com/advisories/46414",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1179239",
"http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt",
"http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42",
"http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48",
"http://www.contextis.com/research/blog/reverseproxybypass/",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.exploit-db.com/exploits/17969",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:144",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.redhat.com/support/errata/RHSA-2011-1391.html",
"http://www.redhat.com/support/errata/RHSA-2011-1392.html",
"http://www.securityfocus.com/bid/49957",
"http://www.securitytracker.com/id?1026144",
"https://bugzilla.redhat.com/show_bug.cgi?id=740045",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/70336",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://osvdb.org/76079",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://seclists.org/fulldisclosure/2011/Oct/232",
"http://seclists.org/fulldisclosure/2011/Oct/273",
"http://secunia.com/advisories/46288",
"http://secunia.com/advisories/46414",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1179239",
"http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt",
"http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42",
"http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48",
"http://www.contextis.com/research/blog/reverseproxybypass/",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.exploit-db.com/exploits/17969",
"http://www.mandriva.com/security/advisories?name=MDVSA-2011:144",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.redhat.com/support/errata/RHSA-2011-1391.html",
"http://www.redhat.com/support/errata/RHSA-2011-1392.html",
"http://www.securityfocus.com/bid/49957",
"http://www.securitytracker.com/id?1026144",
"https://bugzilla.redhat.com/show_bug.cgi?id=740045",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/70336",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.",
"vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"weakness": "CWE-20"
},
"CVE-2011-3607": {
"id": "CVE-2011-3607",
"references": [
"http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/45793",
"http://secunia.com/advisories/48551",
"http://securitytracker.com/id?1026267",
"http://support.apple.com/kb/HT5501",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.osvdb.org/76744",
"http://www.securityfocus.com/bid/50494",
"https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422",
"https://bugzilla.redhat.com/show_bug.cgi?id=750935",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/71093",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/45793",
"http://secunia.com/advisories/48551",
"http://securitytracker.com/id?1026267",
"http://support.apple.com/kb/HT5501",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.osvdb.org/76744",
"http://www.securityfocus.com/bid/50494",
"https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422",
"https://bugzilla.redhat.com/show_bug.cgi?id=750935",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/71093",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 4.4,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.",
"vector_string": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"weakness": "CWE-189"
},
"CVE-2011-3639": {
"id": "CVE-2011-3639",
"references": [
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://svn.apache.org/viewvc?view=revision&revision=1188745",
"http://www.debian.org/security/2012/dsa-2405",
"https://bugzilla.redhat.com/show_bug.cgi?id=752080",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://svn.apache.org/viewvc?view=revision&revision=1188745",
"http://www.debian.org/security/2012/dsa-2405",
"https://bugzilla.redhat.com/show_bug.cgi?id=752080"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-20"
},
"CVE-2011-4317": {
"id": "CVE-2011-4317",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://thread.gmane.org/gmane.comp.apache.devel/46440",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securitytracker.com/id?1026353",
"https://bugzilla.redhat.com/show_bug.cgi?id=756483",
"https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://thread.gmane.org/gmane.comp.apache.devel/46440",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:003",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securitytracker.com/id?1026353",
"https://bugzilla.redhat.com/show_bug.cgi?id=756483",
"https://community.qualys.com/blogs/securitylabs/2011/11/23/apache-reverse-proxy-bypass-issue",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-20"
},
"CVE-2011-4415": {
"id": "CVE-2011-4415",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://www.gossamer-threads.com/lists/apache/dev/403775",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://www.gossamer-threads.com/lists/apache/dev/403775",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/",
"http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html"
],
"score": 1.2,
"services": [
"443/http"
],
"severity": "low",
"summary": "The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the \"len +=\" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.",
"vector_string": "AV:L/AC:H/Au:N/C:N/I:N/A:P",
"weakness": "CWE-20"
},
"CVE-2012-0031": {
"id": "CVE-2012-0031",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/47410",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1230065",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securityfocus.com/bid/51407",
"https://bugzilla.redhat.com/show_bug.cgi?id=773744",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://marc.info/?l=bugtraq&m=134987041210674&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/47410",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1230065",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securityfocus.com/bid/51407",
"https://bugzilla.redhat.com/show_bug.cgi?id=773744",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 4.6,
"services": [
"443/http"
],
"severity": "medium",
"summary": "scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.",
"vector_string": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2012-0053": {
"id": "CVE-2012-0053",
"references": [
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=136441204617335&w=2",
"http://marc.info/?l=bugtraq&m=136441204617335&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1235454",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securityfocus.com/bid/51706",
"https://bugzilla.redhat.com/show_bug.cgi?id=785069",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://kb.juniper.net/JSA10585",
"http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html",
"http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133294460209056&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133494237717847&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=133951357207000&w=2",
"http://marc.info/?l=bugtraq&m=136441204617335&w=2",
"http://marc.info/?l=bugtraq&m=136441204617335&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-0128.html",
"http://rhn.redhat.com/errata/RHSA-2012-0542.html",
"http://rhn.redhat.com/errata/RHSA-2012-0543.html",
"http://secunia.com/advisories/48551",
"http://support.apple.com/kb/HT5501",
"http://svn.apache.org/viewvc?view=revision&revision=1235454",
"http://www.debian.org/security/2012/dsa-2405",
"http://www.mandriva.com/security/advisories?name=MDVSA-2012:012",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"http://www.securityfocus.com/bid/51706",
"https://bugzilla.redhat.com/show_bug.cgi?id=785069",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.",
"vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2012-0883": {
"id": "CVE-2012-0883",
"references": [
"http://article.gmane.org/gmane.comp.apache.devel/48158",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://marc.info/?l=bugtraq&m=134012830914727&w=2",
"http://secunia.com/advisories/48849",
"http://support.apple.com/kb/HT5880",
"http://svn.apache.org/viewvc?view=revision&revision=1296428",
"http://www.apache.org/dist/httpd/Announcement2.4.html",
"http://www.apachelounge.com/Changelog-2.4.html",
"http://www.securityfocus.com/bid/53046",
"http://www.securitytracker.com/id?1026932",
"http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/74901",
"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E"
],
"score": 6.9,
"services": [
"443/http"
],
"severity": "medium",
"summary": "envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.",
"vector_string": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2012-2687": {
"id": "CVE-2012-2687",
"references": [
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00011.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%3C0BFFEA9B-801B-4BAA-9534-56F640268E30%40apache.org%3E",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-1591.html",
"http://rhn.redhat.com/errata/RHSA-2012-1592.html",
"http://rhn.redhat.com/errata/RHSA-2012-1594.html",
"http://rhn.redhat.com/errata/RHSA-2013-0130.html",
"http://secunia.com/advisories/50894",
"http://secunia.com/advisories/51607",
"http://support.apple.com/kb/HT5880",
"http://www-01.ibm.com/support/docview.wss?uid=nas2a2b50a0ca011b37c86257a96003c9a4f",
"http://www.apache.org/dist/httpd/CHANGES_2.4.3",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.securityfocus.com/bid/55131",
"http://www.ubuntu.com/usn/USN-1627-1",
"http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18832",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19539",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00011.html",
"http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html",
"http://mail-archives.apache.org/mod_mbox/www-announce/201208.mbox/%3C0BFFEA9B-801B-4BAA-9534-56F640268E30%40apache.org%3E",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2012-1591.html",
"http://rhn.redhat.com/errata/RHSA-2012-1592.html",
"http://rhn.redhat.com/errata/RHSA-2012-1594.html",
"http://rhn.redhat.com/errata/RHSA-2013-0130.html",
"http://secunia.com/advisories/50894",
"http://secunia.com/advisories/51607",
"http://support.apple.com/kb/HT5880",
"http://www-01.ibm.com/support/docview.wss?uid=nas2a2b50a0ca011b37c86257a96003c9a4f",
"http://www.apache.org/dist/httpd/CHANGES_2.4.3",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
"http://www.securityfocus.com/bid/55131",
"http://www.ubuntu.com/usn/USN-1627-1",
"http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18832",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19539"
],
"score": 2.6,
"services": [
"443/http"
],
"severity": "low",
"summary": "Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.",
"vector_string": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2012-3499": {
"id": "CVE-2012-3499",
"references": [
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://secunia.com/advisories/55032",
"http://support.apple.com/kb/HT5880",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_info.c?r1=1225799&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1389564&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache_mgr.c?r1=1209766&r2=1418752&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_imagemap.c?r1=1398480&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1404625&r2=1413732&diff_format=h",
"http://www.debian.org/security/2013/dsa-2637",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/58165",
"http://www.securityfocus.com/bid/64758",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19312",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://secunia.com/advisories/55032",
"http://support.apple.com/kb/HT5880",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_info.c?r1=1225799&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1389564&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache_mgr.c?r1=1209766&r2=1418752&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_imagemap.c?r1=1398480&r2=1413732&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1404625&r2=1413732&diff_format=h",
"http://www.debian.org/security/2013/dsa-2637",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/58165",
"http://www.securityfocus.com/bid/64758",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19312"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2012-4558": {
"id": "CVE-2012-4558",
"references": [
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://support.apple.com/kb/HT5880",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?r1=1404653&r2=1413732&diff_format=h",
"http://www.debian.org/security/2013/dsa-2637",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/58165",
"http://www.securityfocus.com/bid/64758",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18977",
"http://httpd.apache.org/security/vulnerabilities_22.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://marc.info/?l=bugtraq&m=136612293908376&w=2",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://support.apple.com/kb/HT5880",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?r1=1404653&r2=1413732&diff_format=h",
"http://www.debian.org/security/2013/dsa-2637",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/58165",
"http://www.securityfocus.com/bid/64758",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18977"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"weakness": "CWE-79"
},
"CVE-2013-1862": {
"id": "CVE-2013-1862",
"references": [
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
"http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://secunia.com/advisories/55032",
"http://support.apple.com/kb/HT6150",
"http://svn.apache.org/viewvc?view=revision&revision=r1469311",
"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862",
"http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:174",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/59826",
"http://www.securityfocus.com/bid/64758",
"http://www.ubuntu.com/usn/USN-1903-1",
"https://bugzilla.redhat.com/show_bug.cgi?id=953729",
"https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
"https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
"http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch",
"http://rhn.redhat.com/errata/RHSA-2013-0815.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://secunia.com/advisories/55032",
"http://support.apple.com/kb/HT6150",
"http://svn.apache.org/viewvc?view=revision&revision=r1469311",
"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862",
"http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
"http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html",
"http://www.mandriva.com/security/advisories?name=MDVSA-2013:174",
"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html",
"http://www.securityfocus.com/bid/59826",
"http://www.securityfocus.com/bid/64758",
"http://www.ubuntu.com/usn/USN-1903-1",
"https://bugzilla.redhat.com/show_bug.cgi?id=953729",
"https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
"https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534"
],
"score": 5.1,
"services": [
"443/http"
],
"severity": "medium",
"summary": "mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.",
"vector_string": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2013-1896": {
"id": "CVE-2013-1896",
"references": [
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html",
"http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html",
"http://rhn.redhat.com/errata/RHSA-2013-1156.html",
"http://rhn.redhat.com/errata/RHSA-2013-1207.html",
"http://rhn.redhat.com/errata/RHSA-2013-1208.html",
"http://rhn.redhat.com/errata/RHSA-2013-1209.html",
"http://secunia.com/advisories/55032",
"http://support.apple.com/kb/HT6150",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log",
"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1896",
"http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
"http://www.apache.org/dist/httpd/Announcement2.2.html",
"http://www.securityfocus.com/bid/61129",
"http://www.ubuntu.com/usn/USN-1903-1",
"https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18835",
"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19747"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2013-5704": {
"id": "CVE-2013-5704",
"references": [
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://martin.swende.se/blog/HTTPChunked.html",
"http://rhn.redhat.com/errata/RHSA-2015-0325.html",
"http://rhn.redhat.com/errata/RHSA-2015-1249.html",
"http://rhn.redhat.com/errata/RHSA-2015-2661.html",
"http://rhn.redhat.com/errata/RHSA-2016-0061.html",
"http://rhn.redhat.com/errata/RHSA-2016-0062.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:174",
"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/bid/66550",
"http://www.ubuntu.com/usn/USN-2523-1",
"https://access.redhat.com/errata/RHSA-2015:2659",
"https://access.redhat.com/errata/RHSA-2015:2660",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659",
"https://support.apple.com/HT205219",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://martin.swende.se/blog/HTTPChunked.html",
"http://rhn.redhat.com/errata/RHSA-2015-0325.html",
"http://rhn.redhat.com/errata/RHSA-2015-1249.html",
"http://rhn.redhat.com/errata/RHSA-2015-2661.html",
"http://rhn.redhat.com/errata/RHSA-2016-0061.html",
"http://rhn.redhat.com/errata/RHSA-2016-0062.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:174",
"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/bid/66550",
"http://www.ubuntu.com/usn/USN-2523-1",
"https://access.redhat.com/errata/RHSA-2015:2659",
"https://access.redhat.com/errata/RHSA-2015:2660",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659",
"https://support.apple.com/HT205219"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a security issue in httpd as such.\"",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2013-6438": {
"id": "CVE-2013-6438",
"references": [
"http://advisories.mageia.org/MGASA-2014-0135.html",
"http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html",
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=141017844705317&w=2",
"http://marc.info/?l=bugtraq&m=141390017113542&w=2",
"http://seclists.org/fulldisclosure/2014/Dec/23",
"http://secunia.com/advisories/58230",
"http://secunia.com/advisories/59315",
"http://secunia.com/advisories/59345",
"http://secunia.com/advisories/60536",
"http://security.gentoo.org/glsa/glsa-201408-12.xml",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c?r1=1528718&r2=1556428&diff_format=h",
"http://www-01.ibm.com/support/docview.wss?uid=swg21669554",
"http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
"http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
"http://www.apache.org/dist/httpd/CHANGES_2.4.9",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"http://www.securityfocus.com/archive/1/534161/100/0/threaded",
"http://www.securityfocus.com/bid/66303",
"http://www.ubuntu.com/usn/USN-2152-1",
"http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2013-6438",
"https://support.apple.com/HT204659",
"https://support.apple.com/kb/HT6535"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2014-0098": {
"id": "CVE-2014-0098",
"references": [
"http://advisories.mageia.org/MGASA-2014-0135.html",
"http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html",
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=141017844705317&w=2",
"http://marc.info/?l=bugtraq&m=141390017113542&w=2",
"http://seclists.org/fulldisclosure/2014/Dec/23",
"http://secunia.com/advisories/58230",
"http://secunia.com/advisories/58915",
"http://secunia.com/advisories/59219",
"http://secunia.com/advisories/59315",
"http://secunia.com/advisories/59345",
"http://secunia.com/advisories/60536",
"http://security.gentoo.org/glsa/glsa-201408-12.xml",
"http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15320.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/loggers/mod_log_config.c?r1=1575394&r2=1575400&diff_format=h",
"http://www-01.ibm.com/support/docview.wss?uid=swg21668973",
"http://www-01.ibm.com/support/docview.wss?uid=swg21676091",
"http://www-01.ibm.com/support/docview.wss?uid=swg21676092",
"http://www.apache.org/dist/httpd/CHANGES_2.4.9",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
"http://www.securityfocus.com/archive/1/534161/100/0/threaded",
"http://www.securityfocus.com/bid/66303",
"http://www.ubuntu.com/usn/USN-2152-1",
"http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
"https://blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2014-0098",
"https://support.apple.com/HT204659",
"https://support.apple.com/kb/HT6535"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2014-0118": {
"id": "CVE-2014-0118",
"references": [
"http://advisories.mageia.org/MGASA-2014-0304.html",
"http://advisories.mageia.org/MGASA-2014-0305.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143748090628601&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://rhn.redhat.com/errata/RHSA-2014-1019.html",
"http://rhn.redhat.com/errata/RHSA-2014-1020.html",
"http://rhn.redhat.com/errata/RHSA-2014-1021.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_deflate.c?r1=1604353&r2=1610501&diff_format=h",
"http://www.debian.org/security/2014/dsa-2989",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.securityfocus.com/bid/68745",
"https://bugzilla.redhat.com/show_bug.cgi?id=1120601",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2014-0118",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.",
"vector_string": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"weakness": "CWE-400"
},
"CVE-2014-0226": {
"id": "CVE-2014-0226",
"references": [
"http://advisories.mageia.org/MGASA-2014-0304.html",
"http://advisories.mageia.org/MGASA-2014-0305.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143748090628601&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://rhn.redhat.com/errata/RHSA-2014-1019.html",
"http://rhn.redhat.com/errata/RHSA-2014-1020.html",
"http://rhn.redhat.com/errata/RHSA-2014-1021.html",
"http://seclists.org/fulldisclosure/2014/Jul/114",
"http://secunia.com/advisories/60536",
"http://security.gentoo.org/glsa/glsa-201408-12.xml",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_status.c?r1=1450998&r2=1610491&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/lua/lua_request.c?r1=1588989&r2=1610491&diff_format=h",
"http://www.debian.org/security/2014/dsa-2989",
"http://www.exploit-db.com/exploits/34133",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.osvdb.org/109216",
"http://www.securityfocus.com/bid/68678",
"http://zerodayinitiative.com/advisories/ZDI-14-236/",
"https://bugzilla.redhat.com/show_bug.cgi?id=1120603",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2014-0226",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659",
"https://www.povonsec.com/apache-2-4-7-exploit/"
],
"score": 6.8,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.",
"vector_string": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"weakness": "CWE-362"
},
"CVE-2014-0231": {
"id": "CVE-2014-0231",
"references": [
"http://advisories.mageia.org/MGASA-2014-0304.html",
"http://advisories.mageia.org/MGASA-2014-0305.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143748090628601&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html",
"http://rhn.redhat.com/errata/RHSA-2014-1019.html",
"http://rhn.redhat.com/errata/RHSA-2014-1020.html",
"http://rhn.redhat.com/errata/RHSA-2014-1021.html",
"http://secunia.com/advisories/60536",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h",
"http://www.debian.org/security/2014/dsa-2989",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.securityfocus.com/bid/68742",
"https://bugzilla.redhat.com/show_bug.cgi?id=1120596",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2014-0231",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659",
"http://advisories.mageia.org/MGASA-2014-0304.html",
"http://advisories.mageia.org/MGASA-2014-0305.html",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143403519711434&w=2",
"http://marc.info/?l=bugtraq&m=143748090628601&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html",
"http://rhn.redhat.com/errata/RHSA-2014-1019.html",
"http://rhn.redhat.com/errata/RHSA-2014-1020.html",
"http://rhn.redhat.com/errata/RHSA-2014-1021.html",
"http://secunia.com/advisories/60536",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=h",
"http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=h",
"http://www.debian.org/security/2014/dsa-2989",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:142",
"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html",
"http://www.securityfocus.com/bid/68742",
"https://bugzilla.redhat.com/show_bug.cgi?id=1120596",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/cve-2014-0231",
"https://security.gentoo.org/glsa/201504-03",
"https://support.apple.com/HT204659"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-399"
},
"CVE-2015-0228": {
"id": "CVE-2015-0228",
"references": [
"http://advisories.mageia.org/MGASA-2015-0099.html",
"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2015-03/msg00006.html",
"http://rhn.redhat.com/errata/RHSA-2015-1666.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES",
"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/bid/73041",
"http://www.securityfocus.com/bid/91787",
"http://www.securitytracker.com/id/1032967",
"http://www.ubuntu.com/usn/USN-2523-1",
"https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef",
"https://github.com/apache/httpd/commit/78eb3b9235515652ed141353d98c239237030410",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://support.apple.com/HT205219",
"https://support.apple.com/kb/HT205031",
"http://advisories.mageia.org/MGASA-2015-0099.html",
"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2015-03/msg00006.html",
"http://rhn.redhat.com/errata/RHSA-2015-1666.html",
"http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES",
"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/bid/73041",
"http://www.securityfocus.com/bid/91787",
"http://www.securitytracker.com/id/1032967",
"http://www.ubuntu.com/usn/USN-2523-1",
"https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef",
"https://github.com/apache/httpd/commit/78eb3b9235515652ed141353d98c239237030410",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://support.apple.com/HT205219",
"https://support.apple.com/kb/HT205031"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"weakness": "CWE-20"
},
"CVE-2015-3183": {
"id": "CVE-2015-3183",
"references": [
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735",
"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://rhn.redhat.com/errata/RHSA-2015-1666.html",
"http://rhn.redhat.com/errata/RHSA-2015-1667.html",
"http://rhn.redhat.com/errata/RHSA-2015-1668.html",
"http://rhn.redhat.com/errata/RHSA-2015-2661.html",
"http://rhn.redhat.com/errata/RHSA-2016-0061.html",
"http://rhn.redhat.com/errata/RHSA-2016-0062.html",
"http://rhn.redhat.com/errata/RHSA-2016-2054.html",
"http://rhn.redhat.com/errata/RHSA-2016-2055.html",
"http://rhn.redhat.com/errata/RHSA-2016-2056.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4",
"http://www.debian.org/security/2015/dsa-3325",
"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
"http://www.securityfocus.com/bid/75963",
"http://www.securityfocus.com/bid/91787",
"http://www.securitytracker.com/id/1032967",
"http://www.ubuntu.com/usn/USN-2686-1",
"https://access.redhat.com/errata/RHSA-2015:2659",
"https://access.redhat.com/errata/RHSA-2015:2660",
"https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6",
"https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/CVE-2015-3183",
"https://security.gentoo.org/glsa/201610-02",
"https://support.apple.com/HT205219",
"https://support.apple.com/kb/HT205031",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735",
"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html",
"http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://marc.info/?l=bugtraq&m=144493176821532&w=2",
"http://rhn.redhat.com/errata/RHSA-2015-1666.html",
"http://rhn.redhat.com/errata/RHSA-2015-1667.html",
"http://rhn.redhat.com/errata/RHSA-2015-1668.html",
"http://rhn.redhat.com/errata/RHSA-2015-2661.html",
"http://rhn.redhat.com/errata/RHSA-2016-0061.html",
"http://rhn.redhat.com/errata/RHSA-2016-0062.html",
"http://rhn.redhat.com/errata/RHSA-2016-2054.html",
"http://rhn.redhat.com/errata/RHSA-2016-2055.html",
"http://rhn.redhat.com/errata/RHSA-2016-2056.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4",
"http://www.debian.org/security/2015/dsa-3325",
"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
"http://www.securityfocus.com/bid/75963",
"http://www.securityfocus.com/bid/91787",
"http://www.securitytracker.com/id/1032967",
"http://www.ubuntu.com/usn/USN-2686-1",
"https://access.redhat.com/errata/RHSA-2015:2659",
"https://access.redhat.com/errata/RHSA-2015:2660",
"https://github.com/apache/httpd/commit/a6027e56924bb6227c1fdbf6f91e7e2438338be6",
"https://github.com/apache/httpd/commit/e427c41257957b57036d5a549b260b6185d1dd73",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://puppet.com/security/cve/CVE-2015-3183",
"https://security.gentoo.org/glsa/201610-02",
"https://support.apple.com/HT205219",
"https://support.apple.com/kb/HT205031"
],
"score": 5,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.",
"vector_string": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"weakness": "CWE-17"
},
"CVE-2016-4975": {
"id": "CVE-2016-4975",
"references": [
"http://www.securityfocus.com/bid/105093",
"https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180926-0006/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"score": 6.1,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"weakness": "CWE-93"
},
"CVE-2016-5387": {
"id": "CVE-2016-5387",
"references": [
"http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html",
"http://rhn.redhat.com/errata/RHSA-2016-1624.html",
"http://rhn.redhat.com/errata/RHSA-2016-1625.html",
"http://rhn.redhat.com/errata/RHSA-2016-1648.html",
"http://rhn.redhat.com/errata/RHSA-2016-1649.html",
"http://rhn.redhat.com/errata/RHSA-2016-1650.html",
"http://www.debian.org/security/2016/dsa-3623",
"http://www.kb.cert.org/vuls/id/797896",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
"http://www.securityfocus.com/bid/91816",
"http://www.securitytracker.com/id/1036330",
"http://www.ubuntu.com/usn/USN-3038-1",
"https://access.redhat.com/errata/RHSA-2016:1420",
"https://access.redhat.com/errata/RHSA-2016:1421",
"https://access.redhat.com/errata/RHSA-2016:1422",
"https://access.redhat.com/errata/RHSA-2016:1635",
"https://access.redhat.com/errata/RHSA-2016:1636",
"https://access.redhat.com/errata/RHSA-2016:1851",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://httpoxy.org/",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/",
"https://security.gentoo.org/glsa/201701-36",
"https://support.apple.com/HT208221",
"https://www.apache.org/security/asf-httpoxy-response.txt",
"https://www.tenable.com/security/tns-2017-04",
"http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html",
"http://rhn.redhat.com/errata/RHSA-2016-1624.html",
"http://rhn.redhat.com/errata/RHSA-2016-1625.html",
"http://rhn.redhat.com/errata/RHSA-2016-1648.html",
"http://rhn.redhat.com/errata/RHSA-2016-1649.html",
"http://rhn.redhat.com/errata/RHSA-2016-1650.html",
"http://www.debian.org/security/2016/dsa-3623",
"http://www.kb.cert.org/vuls/id/797896",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
"http://www.securityfocus.com/bid/91816",
"http://www.securitytracker.com/id/1036330",
"http://www.ubuntu.com/usn/USN-3038-1",
"https://access.redhat.com/errata/RHSA-2016:1420",
"https://access.redhat.com/errata/RHSA-2016:1421",
"https://access.redhat.com/errata/RHSA-2016:1422",
"https://access.redhat.com/errata/RHSA-2016:1635",
"https://access.redhat.com/errata/RHSA-2016:1636",
"https://access.redhat.com/errata/RHSA-2016:1851",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://httpoxy.org/",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/",
"https://security.gentoo.org/glsa/201701-36",
"https://support.apple.com/HT208221",
"https://www.apache.org/security/asf-httpoxy-response.txt",
"https://www.tenable.com/security/tns-2017-04"
],
"score": 8.1,
"services": [
"443/http"
],
"severity": "high",
"summary": "The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability.",
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2016-8612": {
"id": "CVE-2016-8612",
"references": [
"http://rhn.redhat.com/errata/RHSA-2016-2957.html",
"http://www.securityfocus.com/bid/94939",
"https://access.redhat.com/errata/RHSA-2017:0193",
"https://access.redhat.com/errata/RHSA-2017:0194",
"https://bugzilla.redhat.com/show_bug.cgi?id=1387605",
"https://security.netapp.com/advisory/ntap-20180601-0005/",
"http://rhn.redhat.com/errata/RHSA-2016-2957.html",
"http://www.securityfocus.com/bid/94939",
"https://access.redhat.com/errata/RHSA-2017:0193",
"https://access.redhat.com/errata/RHSA-2017:0194",
"https://bugzilla.redhat.com/show_bug.cgi?id=1387605",
"https://security.netapp.com/advisory/ntap-20180601-0005/"
],
"score": 4.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.",
"vector_string": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"weakness": "CWE-20"
},
"CVE-2016-8743": {
"id": "CVE-2016-8743",
"references": [
"http://rhn.redhat.com/errata/RHSA-2017-1415.html",
"http://www.debian.org/security/2017/dsa-3796",
"http://www.securityfocus.com/bid/95077",
"http://www.securitytracker.com/id/1037508",
"https://access.redhat.com/errata/RHSA-2017:0906",
"https://access.redhat.com/errata/RHSA-2017:1161",
"https://access.redhat.com/errata/RHSA-2017:1413",
"https://access.redhat.com/errata/RHSA-2017:1414",
"https://access.redhat.com/errata/RHSA-2017:1721",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201701-36",
"https://security.netapp.com/advisory/ntap-20180423-0001/",
"https://support.apple.com/HT208221",
"https://www.tenable.com/security/tns-2017-04",
"http://rhn.redhat.com/errata/RHSA-2017-1415.html",
"http://www.debian.org/security/2017/dsa-3796",
"http://www.securityfocus.com/bid/95077",
"http://www.securitytracker.com/id/1037508",
"https://access.redhat.com/errata/RHSA-2017:0906",
"https://access.redhat.com/errata/RHSA-2017:1161",
"https://access.redhat.com/errata/RHSA-2017:1413",
"https://access.redhat.com/errata/RHSA-2017:1414",
"https://access.redhat.com/errata/RHSA-2017:1721",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us",
"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201701-36",
"https://security.netapp.com/advisory/ntap-20180423-0001/",
"https://support.apple.com/HT208221",
"https://www.tenable.com/security/tns-2017-04"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"weakness": "NVD-CWE-noinfo"
},
"CVE-2017-3167": {
"id": "CVE-2017-3167",
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99135",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4%40%3Cdev.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185",
"https://www.tenable.com/security/tns-2019-09",
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99135",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4%40%3Cdev.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-287"
},
"CVE-2017-3169": {
"id": "CVE-2017-3169",
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99134",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3Cdev.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-476"
},
"CVE-2017-7679": {
"id": "CVE-2017-7679",
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99170",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751%40%3Cdev.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185",
"https://www.tenable.com/security/tns-2019-09",
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99170",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751%40%3Cdev.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-126"
},
"CVE-2017-9788": {
"id": "CVE-2017-9788",
"references": [
"http://www.debian.org/security/2017/dsa-3913",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99569",
"http://www.securitytracker.com/id/1038906",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:2708",
"https://access.redhat.com/errata/RHSA-2017:2709",
"https://access.redhat.com/errata/RHSA-2017:2710",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://httpd.apache.org/security/vulnerabilities_22.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb%40%3Cannounce.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20170911-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.tenable.com/security/tns-2019-09",
"http://www.debian.org/security/2017/dsa-3913",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99569",
"http://www.securitytracker.com/id/1038906",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:2708",
"https://access.redhat.com/errata/RHSA-2017:2709",
"https://access.redhat.com/errata/RHSA-2017:2710",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://httpd.apache.org/security/vulnerabilities_22.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb%40%3Cannounce.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20170911-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 9.1,
"services": [
"443/http"
],
"severity": "critical",
"summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"weakness": "CWE-20"
},
"CVE-2017-9798": {
"id": "CVE-2017-9798",
"references": [
"http://openwall.com/lists/oss-security/2017/09/18/2",
"http://www.debian.org/security/2017/dsa-3980",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"http://www.securityfocus.com/bid/100872",
"http://www.securityfocus.com/bid/105598",
"http://www.securitytracker.com/id/1039387",
"https://access.redhat.com/errata/RHSA-2017:2882",
"https://access.redhat.com/errata/RHSA-2017:2972",
"https://access.redhat.com/errata/RHSA-2017:3018",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
"https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
"https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
"https://github.com/hannob/optionsbleed",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security-tracker.debian.org/tracker/CVE-2017-9798",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0003/",
"https://support.apple.com/HT208331",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
"https://www.exploit-db.com/exploits/42745/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
"https://www.tenable.com/security/tns-2019-09",
"http://openwall.com/lists/oss-security/2017/09/18/2",
"http://seclists.org/fulldisclosure/2024/Sep/22",
"http://www.debian.org/security/2017/dsa-3980",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"http://www.securityfocus.com/bid/100872",
"http://www.securityfocus.com/bid/105598",
"http://www.securitytracker.com/id/1039387",
"https://access.redhat.com/errata/RHSA-2017:2882",
"https://access.redhat.com/errata/RHSA-2017:2972",
"https://access.redhat.com/errata/RHSA-2017:3018",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
"https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
"https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a",
"https://github.com/hannob/optionsbleed",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security-tracker.debian.org/tracker/CVE-2017-9798",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0003/",
"https://support.apple.com/HT208331",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
"https://www.exploit-db.com/exploits/42745/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"weakness": "CWE-416"
},
"CVE-2018-1301": {
"id": "CVE-2018-1301",
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/2",
"http://www.securityfocus.com/bid/103515",
"http://www.securitytracker.com/id/1040573",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164",
"https://www.tenable.com/security/tns-2019-09",
"http://www.openwall.com/lists/oss-security/2018/03/24/2",
"http://www.securityfocus.com/bid/103515",
"http://www.securitytracker.com/id/1040573",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 5.9,
"services": [
"443/http"
],
"severity": "medium",
"summary": "A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.",
"vector_string": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-119"
},
"CVE-2018-1302": {
"id": "CVE-2018-1302",
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/5",
"http://www.securityfocus.com/bid/103528",
"http://www.securitytracker.com/id/1040567",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/",
"https://www.tenable.com/security/tns-2019-09",
"http://www.openwall.com/lists/oss-security/2018/03/24/5",
"http://www.securityfocus.com/bid/103528",
"http://www.securitytracker.com/id/1040567",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 5.9,
"services": [
"443/http"
],
"severity": "medium",
"summary": "When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.",
"vector_string": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-476"
},
"CVE-2018-1303": {
"id": "CVE-2018-1303",
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/3",
"http://www.securityfocus.com/bid/103522",
"http://www.securitytracker.com/id/1040572",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164",
"https://www.tenable.com/security/tns-2019-09",
"http://www.openwall.com/lists/oss-security/2018/03/24/3",
"http://www.securityfocus.com/bid/103522",
"http://www.securitytracker.com/id/1040572",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164",
"https://www.tenable.com/security/tns-2019-09"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.",
"vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-125"
},
"CVE-2021-34798": {
"id": "CVE-2021-34798",
"references": [
"http://httpd.apache.org/security/vulnerabilities_24.html",
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2021-17",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2021-17"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-476"
},
"CVE-2021-39275": {
"id": "CVE-2021-39275",
"references": [
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-787"
},
"CVE-2021-40438": {
"id": "CVE-2021-40438",
"references": [
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2021-17",
"https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211008-0004/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
"https://www.debian.org/security/2021/dsa-4982",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2021-17",
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438"
],
"score": 9,
"services": [
"443/http"
],
"severity": "critical",
"summary": "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"weakness": "CWE-918"
},
"CVE-2021-44790": {
"id": "CVE-2021-44790",
"references": [
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html",
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2021/12/20/4",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211224-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.debian.org/security/2022/dsa-5035",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2022-01",
"https://www.tenable.com/security/tns-2022-03",
"http://httpd.apache.org/security/vulnerabilities_24.html",
"http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html",
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2021/12/20/4",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20211224-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.debian.org/security/2022/dsa-5035",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.tenable.com/security/tns-2022-01",
"https://www.tenable.com/security/tns-2022-03"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-787"
},
"CVE-2022-22719": {
"id": "CVE-2022-22719",
"references": [
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/4",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/4",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-665"
},
"CVE-2022-22720": {
"id": "CVE-2022-22720",
"references": [
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/3",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/3",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-444"
},
"CVE-2022-22721": {
"id": "CVE-2022-22721",
"references": [
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/2",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"http://seclists.org/fulldisclosure/2022/May/33",
"http://seclists.org/fulldisclosure/2022/May/35",
"http://seclists.org/fulldisclosure/2022/May/38",
"http://www.openwall.com/lists/oss-security/2022/03/14/2",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220321-0001/",
"https://support.apple.com/kb/HT213255",
"https://support.apple.com/kb/HT213256",
"https://support.apple.com/kb/HT213257",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html"
],
"score": 9.1,
"services": [
"443/http"
],
"severity": "critical",
"summary": "If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"weakness": "CWE-190"
},
"CVE-2022-28330": {
"id": "CVE-2022-28330",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/3",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/3",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 5.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"weakness": "CWE-125"
},
"CVE-2022-28614": {
"id": "CVE-2022-28614",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/4",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/4",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 5.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"weakness": "CWE-190"
},
"CVE-2022-28615": {
"id": "CVE-2022-28615",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/9",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/9",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 9.1,
"services": [
"443/http"
],
"severity": "critical",
"summary": "Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"weakness": "CWE-190"
},
"CVE-2022-29404": {
"id": "CVE-2022-29404",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/5",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/5",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-770"
},
"CVE-2022-30556": {
"id": "CVE-2022-30556",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/7",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/7",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"weakness": "CWE-200"
},
"CVE-2022-31813": {
"id": "CVE-2022-31813",
"references": [
"http://www.openwall.com/lists/oss-security/2022/06/08/8",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/",
"http://www.openwall.com/lists/oss-security/2022/06/08/8",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/",
"https://security.gentoo.org/glsa/202208-20",
"https://security.netapp.com/advisory/ntap-20220624-0005/"
],
"score": 9.8,
"services": [
"443/http"
],
"severity": "critical",
"summary": "Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-348"
},
"CVE-2022-37436": {
"id": "CVE-2022-37436",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.gentoo.org/glsa/202309-01",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.gentoo.org/glsa/202309-01"
],
"score": 5.3,
"services": [
"443/http"
],
"severity": "medium",
"summary": "Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"weakness": "CWE-113"
},
"CVE-2023-25690": {
"id": "CVE-2023-25690",
"references": [
"http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html",
"https://security.gentoo.org/glsa/202309-01",
"http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html",
"https://security.gentoo.org/glsa/202309-01"
],
"score": 9.8,
"services": [
"80/http"
],
"severity": "critical",
"summary": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\n\n\n\n\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule\n or ProxyPassMatch in which a non-specific pattern matches\n some portion of the user-supplied request-target (URL) data and is then\n re-inserted into the proxied request-target using variable \nsubstitution. For example, something like:\n\n\n\n\nRewriteEngine on\nRewriteRule \"^/here/(.*)\" \"http://example.com:8080/elsewhere?$1\"; [P]\nProxyPassReverse /here/ http://example.com:8080/\n\n\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"weakness": "CWE-444"
},
"CVE-2023-27522": {
"id": "CVE-2023-27522",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html",
"https://security.gentoo.org/glsa/202309-01"
],
"score": 7.5,
"services": [
"80/http"
],
"severity": "high",
"summary": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.nnSpecial characters in the origin response header can truncate/split the response forwarded to the client.nnn",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"weakness": "CWE-444"
},
"CVE-2023-31122": {
"id": "CVE-2023-31122",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/",
"https://security.netapp.com/advisory/ntap-20231027-0011/",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/TI3V2YCEUM65QDYPGGNUZ7UONIM5OEXC/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/VZJTT5TEFNSBWVMKCLS6EZ7PI6EJYBCO/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZFDNHDH4VLFGDPY6MEZV2RO5N5FLFONW/",
"https://security.netapp.com/advisory/ntap-20231027-0011/"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-125"
},
"CVE-2023-45802": {
"id": "CVE-2023-45802",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
"https://security.netapp.com/advisory/ntap-20231027-0011/"
],
"score": 5.9,
"services": [
"443/http"
],
"severity": "medium",
"summary": "When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.nnThis was found by the reporter during testing ofxa0CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During \"normal\" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.nnUsers are recommended to upgrade to version 2.4.58, which fixes the issue.n",
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"weakness": "CWE-770"
},
"CVE-2024-40898": {
"id": "CVE-2024-40898",
"references": [
"https://httpd.apache.org/security/vulnerabilities_24.html",
"http://www.openwall.com/lists/oss-security/2024/07/17/7",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.netapp.com/advisory/ntap-20240808-0006/"
],
"score": 7.5,
"services": [
"443/http"
],
"severity": "high",
"summary": "SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.\n\nUsers are recommended to upgrade to version 2.4.62 which fixes this issue. ",
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"weakness": "CWE-918"
}
}
}