Red Hat Security AdvisoryRHSA-2014:0920
httpd security update
Released 2014-07-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-87.el5_10, httpd-2.2.3-87.el5_10.i386, httpd-2.2.3-87.el5_10.ia64 +13
- Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-87.el5_10, httpd-2.2.3-87.el5_10.i386, mod_ssl-1:2.2.3-87.el5_10 +1
- Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-31.el6_5, httpd-tools-2.2.15-31.el6_5
- Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-2.2.15-31.el6_5, httpd-devel-2.2.15-31.el6_5, httpd-manual-2.2.15-31.el6_5 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-87.el5_10, httpd-devel-2.2.3-87.el5_10, httpd-devel-2.2.3-87.el5_10.i386 +2
- Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-31.el6_5, httpd-tools-2.2.15-31.el6_5
- Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-2.2.15-31.el6_5, httpd-devel-2.2.15-31.el6_5, httpd-manual-2.2.15-31.el6_5 +1
- Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-31.el6_5, httpd-devel-2.2.15-31.el6_5, httpd-devel-2.2.15-31.el6_5.ppc +3
- Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-31.el6_5, httpd-devel-2.2.15-31.el6_5, httpd-manual-2.2.15-31.el6_5 +2
Fixes 3 records
Priority HIGH 72
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or ex…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.85808 · Published 2014-07-20 · Partial fix CWE-362
Priority MEDIUM 52
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read fr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.4472 · Published 2014-07-20 · Partial fix CWE-399
Priority MEDIUM 47
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resourc…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.37295 · Published 2014-07-20 · Partial fix CWE-400
THREATIST.IORead the docs