VulnerableCode Package Details - pkg:apache/httpd@2.2.16

Vulnerabilities affecting this package (33)

Advisory	Summary	Fixed in package version
CVE-2009-3560	A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2009-3720	A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2010-1623	A flaw was found in the apr_brigade_split_line() function of the bundled APR-util library, used to process non-SSL requests. A remote …	2.0.64 Vulnerable 2.2.17 Vulnerable
CVE-2011-0419	A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory …	2.0.65 Not vulnerable 2.2.19 Vulnerable
CVE-2011-3192	A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use …	2.0.65 Not vulnerable 2.2.20 Vulnerable
CVE-2011-3348	A flaw was found when mod_proxy_ajp is used together with mod_proxy_balancer. Given a specific configuration, a remote attacker could send …	2.2.21 Vulnerable
CVE-2011-3368	An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2011-3607	An integer overflow flaw was found which, when the mod_setenvif module is enabled, could allow local users to gain privileges …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2011-4317	An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag …	2.2.22 Vulnerable
CVE-2012-0031	A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2012-0053	A flaw was found in the default error response for status code 400. This flaw could be used by an …	2.0.65 Not vulnerable 2.2.22 Vulnerable
CVE-2012-0883	Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This …	2.2.23 Vulnerable 2.4.2 Vulnerable
CVE-2012-2687	Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled. Note: This issue …	2.2.23 Vulnerable 2.4.3 Vulnerable
CVE-2012-3499	Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.	2.2.24 Vulnerable 2.4.4 Vulnerable
CVE-2012-4557	A flaw was found when mod_proxy_ajp connects to a backend server that takes too long to respond. Given a specific …	2.2.22 Vulnerable
CVE-2012-4558	A XSS flaw affected the mod_proxy_balancer manager interface.	2.2.24 Vulnerable 2.4.4 Vulnerable
CVE-2013-1862	mod_rewrite does not filter terminal escape sequences from logs, which could make it easier for attackers to insert those sequences …	2.0.65 Not vulnerable 2.2.25 Vulnerable
CVE-2013-1896	Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request …	2.2.25 Vulnerable 2.4.6 Vulnerable
CVE-2013-5704	HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that …	2.2.29 Vulnerable 2.4.12 Vulnerable
CVE-2013-6438	XML parsing code in mod_dav incorrectly calculates the end of the string when removing leading spaces and places a NUL …	2.2.27 Vulnerable 2.4.9 Vulnerable
CVE-2014-0098	A flaw was found in mod_log_config. A remote attacker could send a specific truncated cookie causing a crash. This crash …	2.2.27 Vulnerable 2.4.9 Vulnerable
CVE-2014-0118	A resource consumption flaw was found in mod_deflate. If request body decompression was configured (using the "DEFLATE" input filter), a …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2014-0226	A race condition was found in mod_status. An attacker able to access a public server status page on a server …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2014-0231	A flaw was found in mod_cgid. If a server using mod_cgid hosted CGI scripts which did not consume standard input, …	2.4.10 Vulnerable 2.2.29 Vulnerable
CVE-2015-3183	An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could …	2.4.16 Vulnerable 2.2.31 Vulnerable
CVE-2016-4975	Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2016-5387	HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2016-8743	Apache HTTP Server, prior to release 2.4.25 (and 2.2.32), accepted a broad pattern of unusual whitespace patterns from the user-agent, …	2.4.25 Vulnerable 2.2.32 Vulnerable
CVE-2017-3167	Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party …	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-3169	mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-7679	mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.	2.2.34 Vulnerable 2.4.26 Vulnerable
CVE-2017-9788	The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. …	2.2.34 Vulnerable 2.4.27 Vulnerable
CVE-2017-9798	When an unrecognized HTTP Method is given in an <Limit {method}> directive in an .htaccess file, and that .htaccess file …	2.4.28 Vulnerable

Next non-vulnerable version	2.4.42
Latest non-vulnerable version	2.4.54
Risk score

Advisory	Summary	Aliases
CVE-2010-1452	A flaw was found in the handling of requests by mod_cache (2.2) and mod_dav (2.0 and 2.2). A malicious remote …
CVE-2010-2068	An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, …