Search for packages
| purl | pkg:rpm/redhat/httpd24-httpd@2.4.25-9.el6?arch=1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1189-ej89-hybs
Aliases: CVE-2017-3169 |
mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. | There are no reported fixed by versions. |
|
VCID-fyrq-yg2u-jkc7
Aliases: CVE-2017-7679 |
mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. | There are no reported fixed by versions. |
|
VCID-jt89-ruvk-1kbj
Aliases: CVE-2017-9788 |
The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault. | There are no reported fixed by versions. |
|
VCID-qayj-kts9-3fde
Aliases: CVE-2017-3167 |
Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request. | There are no reported fixed by versions. |
|
VCID-twj7-4qwm-2khv
Aliases: CVE-2017-7668 |
The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. | There are no reported fixed by versions. |
|
VCID-wshe-gf99-tbg6
Aliases: CVE-2017-7659 |
A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||