Search for packages
| purl | pkg:apache/httpd@2.0.61 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1bv2-mkj8-ubaz
Aliases: CVE-2013-1862 |
mod_rewrite does not filter terminal escape sequences from logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. |
Affected by 0 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-3cea-3rkm-r7gs
Aliases: CVE-2011-0419 |
A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack. Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack. Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65) |
Affected by 0 other vulnerabilities. Affected by 30 other vulnerabilities. |
|
VCID-4zzy-q5zp-jkgm
Aliases: CVE-2009-3720 |
A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document (for example through mod_dav) may be able to cause a crash. This crash would only be a denial of service if using the worker MPM. |
Affected by 7 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-56kt-8bg6-zbcj
Aliases: CVE-2010-1452 |
A flaw was found in the handling of requests by mod_cache (2.2) and mod_dav (2.0 and 2.2). A malicious remote attacker could send a carefully crafted request and cause a httpd child process to crash. This crash would only be a denial of service if using the worker MPM. This issue is further mitigated as mod_dav is only affected by requests that are most likely to be authenticated, and mod_cache is only affected if the uncommon "CacheIgnoreURLSessionIdentifiers" directive, introduced in version 2.2.14, is used. |
Affected by 7 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-5yez-d5nj-q7eq
Aliases: CVE-2011-3607 |
An integer overflow flaw was found which, when the mod_setenvif module is enabled, could allow local users to gain privileges via a .htaccess file. |
Affected by 0 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-6d43-sjqw-tbbp
Aliases: CVE-2009-3095 |
A flaw was found in the mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server. |
Affected by 7 other vulnerabilities. Affected by 38 other vulnerabilities. |
|
VCID-7krj-8vat-3ydy
Aliases: CVE-2010-0425 |
A flaw was found with within mod_isapi which would attempt to unload the ISAPI dll when it encountered various error states. This could leave the callbacks in an undefined state and result in a segfault. On Windows platforms using mod_isapi, a remote attacker could send a malicious request to trigger this issue, and as win32 MPM runs only one process, this would result in a denial of service, and potentially allow arbitrary code execution. |
Affected by 7 other vulnerabilities. Affected by 35 other vulnerabilities. |
|
VCID-d4rc-pnv5-6uc8
Aliases: CVE-2012-0053 |
A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified. |
Affected by 0 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-dqkp-f1my-dbg9
Aliases: CVE-2007-5000 |
A flaw was found in the mod_imagemap module. On sites where mod_imagemap is enabled and an imagemap file is publicly available, a cross-site scripting attack is possible. |
Affected by 19 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-fn5k-e2jr-6ube
Aliases: CVE-2008-2364 |
A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. A remote attacker could cause a denial of service or high memory usage. |
Affected by 7 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-g2pp-aahn-mfcd
Aliases: CVE-2008-2939 |
A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp is enabled to support FTP-over-HTTP, requests containing globbing characters could lead to cross-site scripting (XSS) attacks. |
Affected by 7 other vulnerabilities. Affected by 47 other vulnerabilities. |
|
VCID-kgpj-aexq-7kah
Aliases: CVE-2007-6388 |
A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly accessible, a cross-site scripting attack is possible. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available. |
Affected by 19 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-kkfv-4jd1-bqdm
Aliases: CVE-2011-3192 |
A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially-crafted Range header. This could be used in a denial of service attack. Advisory: CVE-2011-3192.txt |
Affected by 0 other vulnerabilities. Affected by 29 other vulnerabilities. |
|
VCID-pdj3-4txb-vych
Aliases: CVE-2009-1891 |
A denial of service flaw was found in the mod_deflate module. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. |
Affected by 7 other vulnerabilities. Affected by 42 other vulnerabilities. |
|
VCID-prd8-51a5-pygj
Aliases: CVE-2011-3368 |
An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released. Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/ |
Affected by 0 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-qtav-hqnd-b7fa
Aliases: CVE-2009-3560 |
A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document (for example through mod_dav) may be able to cause a crash. This crash would only be a denial of service if using the worker MPM. |
Affected by 7 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-ss79-kcpu-mqd5
Aliases: CVE-2008-0005 |
A workaround was added in the mod_proxy_ftp module. On sites where mod_proxy_ftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616. |
Affected by 19 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-umuk-3n1q-3qet
Aliases: CVE-2009-2412 |
A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way. |
Affected by 7 other vulnerabilities. Affected by 41 other vulnerabilities. |
|
VCID-wycq-jwzz-q7hf
Aliases: CVE-2010-0434 |
A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array to the subrequest, instead of a pointer to the parent request's array as it had for requests without request bodies. This meant all modules such as mod_headers which may manipulate the input headers for a subrequest would poison the parent request in two ways, one by modifying the parent request, which might not be intended, and second by leaving pointers to modified header fields in memory allocated to the subrequest scope, which could be freed before the main request processing was finished, resulting in a segfault or in revealing data from another request on threaded servers, such as the worker or winnt MPMs. |
Affected by 7 other vulnerabilities. Affected by 35 other vulnerabilities. |
|
VCID-y8nd-7h3r-7fh5
Aliases: CVE-2010-1623 |
A flaw was found in the apr_brigade_split_line() function of the bundled APR-util library, used to process non-SSL requests. A remote attacker could send requests, carefully crafting the timing of individual bytes, which would slowly consume memory, potentially leading to a denial of service. |
Affected by 7 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-ym93-sxb8-fkdm
Aliases: CVE-2012-0031 |
A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly. |
Affected by 0 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-zkbr-1m2z-ufe7
Aliases: CVE-2009-3094 |
A NULL pointer dereference flaw was found in the mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service. |
Affected by 7 other vulnerabilities. Affected by 38 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1nh6-77uc-xbak | A bug was found in the mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. |
CVE-2007-1863
|
| VCID-95zk-suqh-j7e7 | A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. |
CVE-2007-3847
|
| VCID-j3mb-97k1-uuh9 | A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available. |
CVE-2006-5752
|
| VCID-srxw-jjvr-p3d5 | The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the HTTP server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service. |
CVE-2007-3304
|
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T12:36:18.738185+00:00 | Apache HTTPD Importer | Affected by | VCID-1bv2-mkj8-ubaz | https://httpd.apache.org/security/json/CVE-2013-1862.json | 38.0.0 |
| 2026-04-01T12:36:18.170723+00:00 | Apache HTTPD Importer | Affected by | VCID-d4rc-pnv5-6uc8 | https://httpd.apache.org/security/json/CVE-2012-0053.json | 38.0.0 |
| 2026-04-01T12:36:18.011971+00:00 | Apache HTTPD Importer | Affected by | VCID-ym93-sxb8-fkdm | https://httpd.apache.org/security/json/CVE-2012-0031.json | 38.0.0 |
| 2026-04-01T12:36:17.791489+00:00 | Apache HTTPD Importer | Affected by | VCID-5yez-d5nj-q7eq | https://httpd.apache.org/security/json/CVE-2011-3607.json | 38.0.0 |
| 2026-04-01T12:36:17.599289+00:00 | Apache HTTPD Importer | Affected by | VCID-prd8-51a5-pygj | https://httpd.apache.org/security/json/CVE-2011-3368.json | 38.0.0 |
| 2026-04-01T12:36:17.376084+00:00 | Apache HTTPD Importer | Affected by | VCID-kkfv-4jd1-bqdm | https://httpd.apache.org/security/json/CVE-2011-3192.json | 38.0.0 |
| 2026-04-01T12:36:17.243354+00:00 | Apache HTTPD Importer | Affected by | VCID-3cea-3rkm-r7gs | https://httpd.apache.org/security/json/CVE-2011-0419.json | 38.0.0 |
| 2026-04-01T12:36:17.064732+00:00 | Apache HTTPD Importer | Affected by | VCID-y8nd-7h3r-7fh5 | https://httpd.apache.org/security/json/CVE-2010-1623.json | 38.0.0 |
| 2026-04-01T12:36:16.930945+00:00 | Apache HTTPD Importer | Affected by | VCID-56kt-8bg6-zbcj | https://httpd.apache.org/security/json/CVE-2010-1452.json | 38.0.0 |
| 2026-04-01T12:36:16.796984+00:00 | Apache HTTPD Importer | Affected by | VCID-wycq-jwzz-q7hf | https://httpd.apache.org/security/json/CVE-2010-0434.json | 38.0.0 |
| 2026-04-01T12:36:16.665087+00:00 | Apache HTTPD Importer | Affected by | VCID-7krj-8vat-3ydy | https://httpd.apache.org/security/json/CVE-2010-0425.json | 38.0.0 |
| 2026-04-01T12:36:16.434010+00:00 | Apache HTTPD Importer | Affected by | VCID-4zzy-q5zp-jkgm | https://httpd.apache.org/security/json/CVE-2009-3720.json | 38.0.0 |
| 2026-04-01T12:36:16.289816+00:00 | Apache HTTPD Importer | Affected by | VCID-qtav-hqnd-b7fa | https://httpd.apache.org/security/json/CVE-2009-3560.json | 38.0.0 |
| 2026-04-01T12:36:16.159895+00:00 | Apache HTTPD Importer | Affected by | VCID-6d43-sjqw-tbbp | https://httpd.apache.org/security/json/CVE-2009-3095.json | 38.0.0 |
| 2026-04-01T12:36:16.027611+00:00 | Apache HTTPD Importer | Affected by | VCID-zkbr-1m2z-ufe7 | https://httpd.apache.org/security/json/CVE-2009-3094.json | 38.0.0 |
| 2026-04-01T12:36:15.865301+00:00 | Apache HTTPD Importer | Affected by | VCID-umuk-3n1q-3qet | https://httpd.apache.org/security/json/CVE-2009-2412.json | 38.0.0 |
| 2026-04-01T12:36:15.689448+00:00 | Apache HTTPD Importer | Affected by | VCID-pdj3-4txb-vych | https://httpd.apache.org/security/json/CVE-2009-1891.json | 38.0.0 |
| 2026-04-01T12:36:15.459753+00:00 | Apache HTTPD Importer | Affected by | VCID-g2pp-aahn-mfcd | https://httpd.apache.org/security/json/CVE-2008-2939.json | 38.0.0 |
| 2026-04-01T12:36:15.347960+00:00 | Apache HTTPD Importer | Affected by | VCID-fn5k-e2jr-6ube | https://httpd.apache.org/security/json/CVE-2008-2364.json | 38.0.0 |
| 2026-04-01T12:36:15.192489+00:00 | Apache HTTPD Importer | Affected by | VCID-ss79-kcpu-mqd5 | https://httpd.apache.org/security/json/CVE-2008-0005.json | 38.0.0 |
| 2026-04-01T12:36:14.912414+00:00 | Apache HTTPD Importer | Affected by | VCID-kgpj-aexq-7kah | https://httpd.apache.org/security/json/CVE-2007-6388.json | 38.0.0 |
| 2026-04-01T12:36:14.653804+00:00 | Apache HTTPD Importer | Affected by | VCID-dqkp-f1my-dbg9 | https://httpd.apache.org/security/json/CVE-2007-5000.json | 38.0.0 |
| 2026-04-01T12:36:14.514348+00:00 | Apache HTTPD Importer | Fixing | VCID-95zk-suqh-j7e7 | https://httpd.apache.org/security/json/CVE-2007-3847.json | 38.0.0 |
| 2026-04-01T12:36:14.378900+00:00 | Apache HTTPD Importer | Fixing | VCID-srxw-jjvr-p3d5 | https://httpd.apache.org/security/json/CVE-2007-3304.json | 38.0.0 |
| 2026-04-01T12:36:14.165196+00:00 | Apache HTTPD Importer | Fixing | VCID-1nh6-77uc-xbak | https://httpd.apache.org/security/json/CVE-2007-1863.json | 38.0.0 |
| 2026-04-01T12:36:14.014260+00:00 | Apache HTTPD Importer | Fixing | VCID-j3mb-97k1-uuh9 | https://httpd.apache.org/security/json/CVE-2006-5752.json | 38.0.0 |