Red Hat Security Advisory

RHSA-2008:0008

httpd security update

Released 2008-01-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-11.el5_1.3, httpd-2.2.3-11.el5_1.3.i386, httpd-2.2.3-11.el5_1.3.ia64 +13
Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-11.el5_1.3, httpd-2.2.3-11.el5_1.3.i386, mod_ssl-1:2.2.3-11.el5_1.3 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-11.el5_1.3, httpd-devel-2.2.3-11.el5_1.3, httpd-devel-2.2.3-11.el5_1.3.i386 +2

Fixes 6 records

TI-2007-06094 CVE-2007-6388 · GHSA-www7-pq67-9w24

Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0…

MEDIUM 59

Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to in…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.75891 Published 2008-01-08 Fixed CWE-79

TI-2007-04820 CVE-2007-5000 · GHSA-wxg8-rr3m-222p

Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP…

MEDIUM 50

Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.46603 Published 2007-12-13 Partial fix CWE-79

TI-2007-04325 CVE-2007-4465 · GHSA-7286-985c-74qv

Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server…

MEDIUM 49

Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HT…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.26188 Published 2007-09-14 Fixed CWE-79

TI-2008-00004 CVE-2008-0005 · GHSA-m62c-mf8p-77p9

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before…

LOW 36

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 enco…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.14727 Published 2008-01-12 Fixed CWE-79

TI-2007-06128 CVE-2007-6422 · GHSA-qmrc-358m-f76x

The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0…

LOW 31

The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child pr…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.09951 Published 2008-01-08 Fixed CWE-399

TI-2007-06127 CVE-2007-6421 · GHSA-g65v-mwjw-wg6c

Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the…

LOW 28

Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.08324 Published 2008-01-08 Fixed CWE-79