Withdrawn by the publisher.

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

httpd: ap_get_basic_auth_pw() authentication bypass httpd: mod_ssl NULL pointer dereference httpd: ap_find_token() buffer overread httpd: mod_mime buffer overread httpd: Uninitialized memory reflection in mod_auth_digest

httpd: ap_get_basic_auth_pw() authentication bypass httpd: mod_ssl NULL pointer dereference httpd: mod_http2 NULL pointer dereference httpd: ap_find_token() buffer overread httpd: mod_mime buffer overread httpd: Uninitialized memory reflection in mod_auth_digest

Security update for apache2

Affected: Ubuntu:14.04:LTS: apache2, Ubuntu:16.04:LTS: apache2

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in Apple Mac OS ausnutzen, um Code mit Kernel Privilegien auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Denial of Service Angriff durchzuführen oder vertrauliche Daten einzusehen.