Professional OVAL Repository
[Eng]
[Rus]
[Sign-In]
OVAL
Search
Categories
RedCheck
About
OVAL Definitions
OVAL Items
FSTEC Data Bank Information Security Threats
NKCKI
EOL (End Of Life)
Linux Security Advisories
Mozilla Foundation Security Advisory
IBM
VMware
Cisco
Check Point Software Technologies
Apache
Solaris
FreeBSD
Development
GitHub Enterprise
Google Chrome Security Advisories
Oracle Security Advisories
Adobe Security Advisories
OpenSSL Security Advisories
Microsoft
CVE
CWE
CPE
Latest Updates
OS ROSA
ALT Linux
Astra Linux SE 1.5
Astra Linux SE 1.6
RED OS
DSA (Debian Security Advisory) Patсh Statistics
DSA (Debian Security Advisory) Patсh Feed
DSA (Debian Security Advisory) Vulnerability Feed
DLA (Debian Security Advisory) Patсh Statistics
DLA (Debian Security Advisory) Patсh Feed
DLA (Debian Security Advisory) Vulnerability Feed
ALT Linux (Security Bulletins) Patсh Statistics
ALT Linux (Security Bulletins) Patсh Feed
ALT Linux (Security Bulletins) Vulnerability Feed
RED OS (Security Bulletins) Patсh Statistics
RED OS (Security Bulletins) Patсh Feed
RED OS (Security Bulletins) Vulnerability Feed
USN (Ubuntu Security Notice) Patсh Statistics
USN (Ubuntu Security Notice) Patсh Feed
USN (Ubuntu Security Notice) Vulnerability Feed
RHSA (RedHat Security Advisory) Patсh Statistics
RHSA (RedHat Security Advisory) Patсh Feed
RHSA (RedHat Security Advisory) Vulnerability Feed
ELSA (Oracle Linux Security Advisory) Patсh Statistics
ELSA (Oracle Linux Security Advisory) Patсh Feed
ELSA (Oracle Linux Security Advisory) Vulnerability Feed
SUSE (SUSE Security Advisories) Patсh Statistics
SUSE (SUSE Security Advisories) Patсh Feed
SUSE (SUSE Security Advisories) Vulnerability Feed
openSUSE (openSUSE Security Advisories) Patсh Statistics
openSUSE (openSUSE Security Advisories) Patсh Feed
openSUSE (openSUSE Security Advisories) Vulnerability Feed
Amazon Linux AMI (Security Bulletins) Patсh Statistics
Amazon Linux AMI (Security Bulletins) Patсh Feed
Amazon Linux AMI (Security Bulletins) Vulnerability Feed
Mageia Linux (Security Bulletins) Patсh Statistics
Mageia Linux (Security Bulletins) Patсh Feed
Mageia Linux (Security Bulletins) Vulnerability Feed
OS ROSA SX COBALT 1.0
OS ROSA DX COBALT 1.0
ROSA 7.3 (Security Advisories) Patсh Statistics
ROSA 7.3 (Security Advisories) Patсh Feed
ROSA 7.3 (Security Advisories) Vulnerability Feed
ALT Linux SPT 6.0
ALT Linux SPT 7.0
ALT 8 SP
ALT 9
RED OS Murom 7.1
RED OS Murom 7.2
IBM DB2
VMware Vulnerabilities Advisory (VMSA)
VMware vCenter Patch Advisories
VMware ESXi Patch Advisories
VMware NSX Patches
VMware NSX Vulnerabilities
VMware Photon OS 1.0 Patches
VMware Photon OS 1.0 Vulnerabilities
VMware Photon OS 2.0 Patches
VMware Photon OS 2.0 Vulnerabilities
Cisco ASA
Cisco IOS/NX-OS Advisory
Cisco NX-OS Vulnerabilities
Check Point Gaia
Apache Tomcat Advisories
Apache Tomcat Server
Apache HTTP Server
Python
Node.js
RubyGems
Qt
Microsoft Security Bulletin
Microsoft Knowledge Base Article
Microsoft SharePoint
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016
About OVALdb
User manual
Pricing
Contact us
OVAL Definitions
>
OVAL Definition Details
Id
oval:com.altx-soft.nix:def:13813
[Rus]
Version
9
Class
patch
ALTXid
27941
Language
English
Severity
NotAvailable
Title
USN-787-1 -- apache2 vulnerabilities
Description
Matthew Palmer discovered an underflow flaw in apr-util as included in Apache. An attacker could cause a denial of service via application crash in Apache using a crafted SVNMasterURI directive, .htaccess file, or when using mod_apreq2. This issue only affected Ubuntu 6.06 LTS. Sander de Boer discovered that mod_proxy_ajp would reuse connections when a client closed a connection without sending a request body. A remote attacker could exploit this to obtain sensitive response data. This issue only affected Ubuntu 9.04. Jonathan Peatfield discovered that Apache did not process Includes options correctly. With certain configurations of Options and AllowOverride, a local attacker could use an .htaccess file to override intended restrictions and execute arbitrary code via a Server-Side-Include file. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04. It was discovered that the XML parser did not properly handle entity expansion. A remote attacker could cause a denial of service via memory resource consumption by sending a crafted request to an Apache server configured to use mod_dav or mod_dav_svn. This issue only affected Ubuntu 6.06 LTS. C. Michael Pilato discovered an off-by-one buffer overflow in apr-util when formatting certain strings. For big-endian machines , a remote attacker could cause a denial of service or information disclosure leak. All other architectures for Ubuntu are not considered to be at risk. This issue only affected Ubuntu 6.06 LTS
Family
unix
Platform
Ubuntu 6.06
Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.04
Product
apache2
Reference
VENDOR: USN-787-1
VENDOR: USN-787-1
Id:
USN-787-1
Reference:
https://usn.ubuntu.com/usn/usn-787-1
CVE: CVE-2009-1956
CVE: CVE-2009-1956
Id:
CVE-2009-1956
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956
Comment
: Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
CVSSv2 Score:
6.4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:P
CWE:
189 (Numeric Errors)
References:
http://svn.apache.org/viewvc?view=rev&revision=768417 (CONFIRM)
http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=504390 (CONFIRM)
[oss-security] 20090605 CVE Request (apr-util) (MLIST)
MDVSA-2009:131 (MANDRIVA)
USN-786-1 (UBUNTU)
35251 (BID)
RHSA-2009:1107 (REDHAT)
RHSA-2009:1108 (REDHAT)
34724 (SECUNIA)
35487 (SECUNIA)
35395 (SECUNIA)
USN-787-1 (UBUNTU)
FEDORA-2009-5969 (FEDORA)
FEDORA-2009-6261 (FEDORA)
FEDORA-2009-6014 (FEDORA)
35565 (SECUNIA)
35710 (SECUNIA)
35843 (SECUNIA)
GLSA-200907-03 (GENTOO)
PK91241 (AIXAPAR)
PK88341 (AIXAPAR)
35797 (SECUNIA)
35284 (SECUNIA)
ADV-2009-1907 (VUPEN)
http://support.apple.com/kb/HT3937 (CONFIRM)
APPLE-SA-2009-11-09-1 (APPLE)
ADV-2009-3184 (VUPEN)
http://www-01.ibm.com/support/docview.wss?uid=swg27014463 (CONFIRM)
37221 (SECUNIA)
PK99478 (AIXAPAR)
HPSBUX02612 (HP)
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html (CONFIRM)
MDVSA-2013:150 (MANDRIVA)
oval:org.mitre.oval:def:12237 (OVAL)
oval:org.mitre.oval:def:11567 (OVAL)
[dev] 20090424 Re: Buffer overflow in apr_brigade_vprintf() ? ()
[dev] 20090424 Buffer overflow in apr_brigade_vprintf() ? ()
[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ ()
[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
CVE: CVE-2009-1955
CVE: CVE-2009-1955
Id:
CVE-2009-1955
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955
Comment
: The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3 Score:
7.5
Attack vector:
NETWORK
Attack complexity:
LOW
Privileges required:
NONE
User interaction:
NONE
Scope:
UNCHANGED
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
HIGH
CVSSv3 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE:
776 (Unrestricted Recursive Entity References in DTDs ('XML Bomb'))
References:
http://svn.apache.org/viewvc?view=rev&revision=781403 (CONFIRM)
DSA-1812 (DEBIAN)
35284 (SECUNIA)
[apr-dev] 20090602 [PATCH] prevent "billion laughs" attack against expat (MLIST)
http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 (CONFIRM)
35360 (SECUNIA)
[oss-security] 20090603 CVE request: "billion laughs" attack against Apache APR (MLIST)
MDVSA-2009:131 (MANDRIVA)
35253 (BID)
USN-786-1 (UBUNTU)
RHSA-2009:1108 (REDHAT)
RHSA-2009:1107 (REDHAT)
35487 (SECUNIA)
SSA:2009-167-02 (SLACKWARE)
35444 (SECUNIA)
34724 (SECUNIA)
35395 (SECUNIA)
USN-787-1 (UBUNTU)
FEDORA-2009-5969 (FEDORA)
FEDORA-2009-6014 (FEDORA)
FEDORA-2009-6261 (FEDORA)
35565 (SECUNIA)
35797 (SECUNIA)
PK88342 (AIXAPAR)
PK91241 (AIXAPAR)
35710 (SECUNIA)
35843 (SECUNIA)
GLSA-200907-03 (GENTOO)
ADV-2009-1907 (VUPEN)
36473 (SECUNIA)
http://wiki.rpath.com/Advisories:rPSA-2009-0123 (CONFIRM)
APPLE-SA-2009-11-09-1 (APPLE)
http://support.apple.com/kb/HT3937 (CONFIRM)
ADV-2009-3184 (VUPEN)
http://www-01.ibm.com/support/docview.wss?uid=swg27014463 (CONFIRM)
37221 (SECUNIA)
PK99478 (AIXAPAR)
ADV-2010-1107 (VUPEN)
SUSE-SR:2010:011 (SUSE)
HPSBUX02612 (HP)
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html (CONFIRM)
MDVSA-2013:150 (MANDRIVA)
8842 (EXPLOIT-DB)
oval:org.mitre.oval:def:12473 (OVAL)
oval:org.mitre.oval:def:10270 (OVAL)
20090824 rPSA-2009-0123-1 apr-util (BUGTRAQ)
[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ ()
[httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ ()
[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html ()
CVE: CVE-2009-1195
CVE: CVE-2009-1195
Id:
CVE-2009-1195
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195
Comment
: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
CVSSv2 Score:
4.9
Access vector:
LOCAL
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
COMPLETE
CVSSv2 Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:C
CWE:
16 (Configuration)
References:
35264 (SECUNIA)
https://bugzilla.redhat.com/show_bug.cgi?id=489436 (CONFIRM)
http://svn.apache.org/viewvc?view=rev&revision=772997 (CONFIRM)
35261 (SECUNIA)
RHSA-2009:1075 (REDHAT)
54733 (OSVDB)
1022296 (SECTRACK)
ADV-2009-1444 (VUPEN)
[apache-httpd-dev] 20090423 Includes vs IncludesNoExec security issue - help needed (MLIST)
35115 (BID)
MDVSA-2009:124 (MANDRIVA)
DSA-1816 (DEBIAN)
35453 (SECUNIA)
USN-787-1 (UBUNTU)
35395 (SECUNIA)
RHSA-2009:1156 (REDHAT)
35721 (SECUNIA)
GLSA-200907-04 (GENTOO)
FEDORA-2009-8812 (FEDORA)
SUSE-SA:2009:050 (SUSE)
37152 (SECUNIA)
APPLE-SA-2009-11-09-1 (APPLE)
http://support.apple.com/kb/HT3937 (CONFIRM)
ADV-2009-3184 (VUPEN)
http://wiki.rpath.com/Advisories:rPSA-2009-0142 (CONFIRM)
HPSBUX02612 (HP)
apache-allowoverrides-security-bypass(50808) (XF)
oval:org.mitre.oval:def:8704 (OVAL)
oval:org.mitre.oval:def:12377 (OVAL)
oval:org.mitre.oval:def:11094 (OVAL)
20091113 rPSA-2009-0142-2 httpd mod_ssl (BUGTRAQ)
20091112 rPSA-2009-0142-1 httpd mod_ssl (BUGTRAQ)
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E (MISC)
CVE: CVE-2009-1191
CVE: CVE-2009-1191
Id:
CVE-2009-1191
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1191
Comment
: mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=766938&r2=767089 (CONFIRM)
34663 (BID)
34827 (SECUNIA)
http://www.apache.org/dist/httpd/patches/apply_to_2.2.11/PR46949.diff (CONFIRM)
https://issues.apache.org/bugzilla/show_bug.cgi?id=46949 (CONFIRM)
53921 (OSVDB)
ADV-2009-1147 (VUPEN)
MDVSA-2009:102 (MANDRIVA)
1022264 (SECTRACK)
USN-787-1 (UBUNTU)
35395 (SECUNIA)
GLSA-200907-04 (GENTOO)
35721 (SECUNIA)
http://support.apple.com/kb/HT3937 (CONFIRM)
APPLE-SA-2009-11-09-1 (APPLE)
ADV-2009-3184 (VUPEN)
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html (CONFIRM)
MDVSA-2013:150 (MANDRIVA)
apache-modproxyajp-information-disclosure(50059) (XF)
oval:org.mitre.oval:def:8261 (OVAL)
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E (MISC)
CVE: CVE-2009-0023
CVE: CVE-2009-0023
Id:
CVE-2009-0023
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023
Comment
: The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
CVSSv2 Score:
4.3
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
NONE
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE:
119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
References:
DSA-1812 (DEBIAN)
35221 (BID)
35284 (SECUNIA)
https://bugzilla.redhat.com/show_bug.cgi?id=503928 (CONFIRM)
35360 (SECUNIA)
http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 (CONFIRM)
http://svn.apache.org/viewvc?view=rev&revision=779880 (CONFIRM)
MDVSA-2009:131 (MANDRIVA)
USN-786-1 (UBUNTU)
RHSA-2009:1108 (REDHAT)
RHSA-2009:1107 (REDHAT)
35444 (SECUNIA)
SSA:2009-167-02 (SLACKWARE)
34724 (SECUNIA)
35487 (SECUNIA)
35395 (SECUNIA)
USN-787-1 (UBUNTU)
FEDORA-2009-5969 (FEDORA)
FEDORA-2009-6261 (FEDORA)
FEDORA-2009-6014 (FEDORA)
35565 (SECUNIA)
PK91241 (AIXAPAR)
GLSA-200907-03 (GENTOO)
35710 (SECUNIA)
PK88341 (AIXAPAR)
35797 (SECUNIA)
35843 (SECUNIA)
ADV-2009-1907 (VUPEN)
http://support.apple.com/kb/HT3937 (CONFIRM)
APPLE-SA-2009-11-09-1 (APPLE)
ADV-2009-3184 (VUPEN)
http://www-01.ibm.com/support/docview.wss?uid=swg27014463 (CONFIRM)
PK99478 (AIXAPAR)
37221 (SECUNIA)
http://wiki.rpath.com/Advisories:rPSA-2009-0144 (CONFIRM)
HPSBUX02612 (HP)
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html (CONFIRM)
MDVSA-2013:150 (MANDRIVA)
apache-aprstrmatchprecompile-dos(50964) (XF)
oval:org.mitre.oval:def:12321 (OVAL)
oval:org.mitre.oval:def:10968 (OVAL)
20091112 rPSA-2009-0144-1 apr-util (BUGTRAQ)
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8%40%3Ccvs.httpd.apache.org%3E (MISC)
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E (MISC)
Content available only for registered users!
ovaldb@altx-soft.com