FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  368339
Date:      2014-09-16
Time:      17:35:34Z
Committer: osa

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
7f6108d2-cea8-11e0-9d58-0800279895eaapache -- Range header DoS vulnerability

Apache HTTP server project reports:

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by Apache HTTPD server.


Discovery 2011-08-24
Entry 2011-08-30
Modified 2011-09-01
apache
apache-event
apache-itk
apache-peruser
apache-worker
gt 2.* lt 2.2.20

CVE-2011-3192
https://people.apache.org/~dirkx/CVE-2011-3192.txt
https://svn.apache.org/viewvc?view=revision&revision=1161534
https://svn.apache.org/viewvc?view=revision&revision=1162874
4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0apache -- multiple vulnerabilities

CVE MITRE reports:

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.

A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified.


Discovery 2011-10-05
Entry 2012-01-31
apache
gt 2.* lt 2.2.22

CVE-2011-3368
CVE-2011-3607
CVE-2011-4317
CVE-2012-0021
CVE-2012-0031
CVE-2012-0053
7f6108d2-cea8-11e0-9d58-0800279895eaapache -- Range header DoS vulnerability

Apache HTTP server project reports:

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by Apache HTTPD server.


Discovery 2011-08-24
Entry 2011-08-30
Modified 2011-09-01
apache
apache-event
apache-itk
apache-peruser
apache-worker
gt 2.* lt 2.2.20

CVE-2011-3192
https://people.apache.org/~dirkx/CVE-2011-3192.txt
https://svn.apache.org/viewvc?view=revision&revision=1161534
https://svn.apache.org/viewvc?view=revision&revision=1162874
de2bc01f-dc44-11e1-9f4d-002354ed89bcApache -- Insecure LD_LIBRARY_PATH handling

Apache reports:

Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This could allow a local user to execute code as root if an administrator runs apachectl from an untrusted directory.


Discovery 2012-03-02
Entry 2012-08-01
apache
le 2.2.22_5

apache-event
le 2.2.22_5

apache-itk
le 2.2.22_5

apache-peruser
le 2.2.22_5

apache-worker
le 2.2.22_5

CVE-2012-0883
http://httpd.apache.org/security/vulnerabilities_24.html
http://www.apache.org/dist/httpd/CHANGES_2.4.2
4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0apache -- multiple vulnerabilities

CVE MITRE reports:

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.

A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified.


Discovery 2011-10-05
Entry 2012-01-31
apache
gt 2.* lt 2.2.22

CVE-2011-3368
CVE-2011-3607
CVE-2011-4317
CVE-2012-0021
CVE-2012-0031
CVE-2012-0053