Red Hat Security Advisory

RHSA-2013:0815

httpd security update

Released 2013-05-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-78.el5_9, httpd-2.2.3-78.el5_9.i386, httpd-2.2.3-78.el5_9.ia64 +13
Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-28.el6_4, httpd-tools-2.2.15-28.el6_4
Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-2.2.15-28.el6_4, httpd-devel-2.2.15-28.el6_4, httpd-manual-2.2.15-28.el6_4 +1
Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-28.el6_4, httpd-tools-2.2.15-28.el6_4
Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-2.2.15-28.el6_4, httpd-devel-2.2.15-28.el6_4, httpd-manual-2.2.15-28.el6_4 +1
Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-28.el6_4, httpd-devel-2.2.15-28.el6_4, httpd-devel-2.2.15-28.el6_4.ppc +3
Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-28.el6_4, httpd-devel-2.2.15-28.el6_4, httpd-manual-2.2.15-28.el6_4 +2

Fixes 3 records

TI-2013-01645 CVE-2013-1862 · GHSA-wp7w-p549-c3xq

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25…

MEDIUM 44

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary command…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.24886 Published 2013-06-10 Partial fix

TI-2012-03898 CVE-2012-4558 · GHSA-gvpv-mmxx-g3g2

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in…

MEDIUM 40

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.22913 Published 2013-02-26 Partial fix CWE-79

TI-2012-03027 CVE-2012-3499 · GHSA-88g5-5jg8-6vw5

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x…

MEDIUM 40

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.22913 Published 2013-02-26 Partial fix CWE-79