VulnerableCode Package Details - pkg:apache/httpd@2.2.6

Vulnerabilities affecting this package (54)

Advisory	Summary	Fixed in package version
CVE-2007-5000	A flaw was found in the mod_imagemap module. On sites where mod_imagemap is enabled and an imagemap file is publicly …	1.3.41 Vulnerable 2.0.63 Vulnerable 2.2.8 Vulnerable
CVE-2007-6388	A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly …	1.3.41 Vulnerable 2.0.63 Vulnerable 2.2.8 Vulnerable
CVE-2007-6420	The mod_proxy_balancer provided an administrative interface that could be vulnerable to cross-site request forgery (CSRF) attacks.	2.2.9 Vulnerable
CVE-2007-6421	A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer is enabled, a cross-site scripting attack against an …	2.2.8 Vulnerable
CVE-2007-6422	A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer is enabled, an authorized user could send a …	2.2.8 Vulnerable
CVE-2008-0005	A workaround was added in the mod_proxy_ftp module. On sites where mod_proxy_ftp is enabled and a forward proxy is configured, …	2.0.63 Vulnerable 2.2.8 Vulnerable
CVE-2008-0456	Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_negotiation and allow untrusted uploads to locations which …	2.2.12 Vulnerable
CVE-2008-2364	A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. A remote …	2.2.9 Vulnerable 2.0.64 Vulnerable
CVE-2008-2939	A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp …	2.2.10 Vulnerable 2.0.64 Vulnerable
CVE-2009-0023	A heap-based underwrite flaw was found in the way the bundled copy of the APR-util library created compiled forms of …	2.2.12 Vulnerable
CVE-2009-1195	A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with …	2.2.12 Vulnerable
CVE-2009-1890	A denial of service flaw was found in the mod_proxy module when it was used as a reverse proxy. A …	2.2.12 Vulnerable
CVE-2009-1891	A denial of service flaw was found in the mod_deflate module. This module continued to compress large files until compression …	2.2.12 Vulnerable 2.0.64 Vulnerable
CVE-2009-1955	A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language (XML) parser. …	2.2.12 Vulnerable
CVE-2009-1956	An off-by-one overflow flaw was found in the way the bundled copy of the APR-util library processed a variable list …	2.2.12 Vulnerable
CVE-2009-2412	A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() …	2.0.64 Vulnerable 2.2.13 Vulnerable
CVE-2009-2699	Faulty error handling was found affecting Solaris pollset support (Event Port backend) caused by a bug in APR. A remote …	2.2.14 Vulnerable
CVE-2009-3094	A NULL pointer dereference flaw was found in the mod_proxy_ftp module. A malicious FTP server to which requests are being …	2.0.64 Vulnerable 2.2.14 Vulnerable
CVE-2009-3095	A flaw was found in the mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw …	2.0.64 Vulnerable 2.2.14 Vulnerable
CVE-2009-3560	A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2009-3720	A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2010-0408	mod_proxy_ajp would return the wrong status code if it encountered an error, causing a backend server to be put into …	2.2.15 Vulnerable
CVE-2010-0425	A flaw was found with within mod_isapi which would attempt to unload the ISAPI dll when it encountered various error …	2.0.64 Vulnerable 2.2.15 Vulnerable
CVE-2010-0434	A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array …	2.0.64 Vulnerable 2.2.15 Vulnerable
CVE-2010-1452	A flaw was found in the handling of requests by mod_cache (2.2) and mod_dav (2.0 and 2.2). A malicious remote …	2.0.64 Vulnerable 2.2.16 Vulnerable
CVE-2010-1623	A flaw was found in the apr_brigade_split_line() function of the bundled APR-util library, used to process non-SSL requests. A remote …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2011-0419	A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory …	2.0.65 Not vulnerable 2.2.19 Vulnerable
CVE-2011-3192	A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use …	2.0.65 Not vulnerable 2.2.20 Vulnerable
CVE-2011-3368	An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2011-3607	An integer overflow flaw was found which, when the mod_setenvif module is enabled, could allow local users to gain privileges …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2011-4317	An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag …	2.2.22 Vulnerable
CVE-2012-0031	A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2012-0053	A flaw was found in the default error response for status code 400. This flaw could be used by an …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2012-0883	Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This …	2.2.23 Vulnerable 2.4.2 Vulnerable
CVE-2012-2687	Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled. Note: This issue …	2.2.23 Vulnerable 2.4.3 Vulnerable
CVE-2012-3499	Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.	2.2.24 Vulnerable 2.4.4 Vulnerable
CVE-2012-4558	A XSS flaw affected the mod_proxy_balancer manager interface.	2.2.24 Vulnerable 2.4.4 Vulnerable
CVE-2013-1862	mod_rewrite does not filter terminal escape sequences from logs, which could make it easier for attackers to insert those sequences …	2.0.65 Not vulnerable 2.2.25 Vulnerable
CVE-2013-1896	Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request …	2.2.25 Vulnerable 2.4.6 Vulnerable
CVE-2013-5704	HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that …	2.2.29 Vulnerable 2.4.12 Vulnerable
CVE-2013-6438	XML parsing code in mod_dav incorrectly calculates the end of the string when removing leading spaces and places a NUL …	2.2.27 Vulnerable 2.4.9 Vulnerable
CVE-2014-0098	A flaw was found in mod_log_config. A remote attacker could send a specific truncated cookie causing a crash. This crash …	2.2.27 Vulnerable 2.4.9 Vulnerable
CVE-2014-0118	A resource consumption flaw was found in mod_deflate. If request body decompression was configured (using the "DEFLATE" input filter), a …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2014-0226	A race condition was found in mod_status. An attacker able to access a public server status page on a server …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2014-0231	A flaw was found in mod_cgid. If a server using mod_cgid hosted CGI scripts which did not consume standard input, …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2015-3183	An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could …	2.4.16 Vulnerable 2.2.31 Vulnerable
CVE-2016-4975	Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2016-5387	HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2016-8743	Apache HTTP Server, prior to release 2.4.25 (and 2.2.32), accepted a broad pattern of unusual whitespace patterns from the user-agent, …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2017-3167	Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party …	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-3169	mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-7679	mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-9788	The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. …	2.2.34 Vulnerable 2.4.27 Vulnerable
CVE-2017-9798	When an unrecognized HTTP Method is given in an <Limit {method}> directive in an .htaccess file, and that .htaccess file …	2.4.28 Vulnerable

Next non-vulnerable version	2.4.42
Latest non-vulnerable version	2.4.54
Risk score

Advisory	Summary	Aliases
CVE-2006-5752	A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is …
CVE-2007-1862	The recall_headers function in mod_mem_cache in Apache 2.2.4 did not properly copy all levels of header data, which can cause …
CVE-2007-1863	A bug was found in the mod_cache module. On sites where caching is enabled, a remote attacker could send a …
CVE-2007-3304	The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A …
CVE-2007-3847	A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a …