Red Hat Security AdvisoryRHSA-2015:1666
httpd24-httpd security update
Released 2015-08-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.12-4.el6.2, httpd24-httpd-devel-2.4.12-4.el6.2, httpd24-httpd-manual-2.4.12-4.el6.2 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.12-6.el7.1, httpd24-httpd-devel-2.4.12-6.el7.1, httpd24-httpd-manual-2.4.12-6.el7.1 +5
Fixes 4 records
Priority MEDIUM 61
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, rel…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.74387 · Published 2015-07-20 · Partial fix CWE-17
Priority MEDIUM 40
The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Pi…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.16907 · Published 2015-03-08 · Fixed CWE-20
Priority LOW 37
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authenticatio…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.16306 · Published 2015-07-20 · Partial fix CWE-264
Priority LOW 37
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.12784 · Published 2015-07-20 · Fixed
THREATIST.IORead the docs