Most recent entries from all

ALSA-2022:7647 — Moderate: httpd:2.4 security update

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943) * httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719) * httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721) * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377) * httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404) * httpd: mod_sed: DoS vulnerability (CVE-2022-30522) * httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813) * httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614) * httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615) * httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-01457

Withdrawn: BELL-CVE-2022-22719 — CVE-2022-22719 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2022-22719 — mod_lua Use of uninitialized value of in r:parsebody

Affected: Bitnami: apache

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

certfr-2022-avi-241 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Elles permettent à un attaquant de provoquer u…

certfr-2022-avi-241

cnvd-2022-41639

EUVD-2026-13548

fkie_cve-2022-22719

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

GHSA-2349-9g3v-jxmj

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

gsd-2022-22719

msrc_CVE-2022-22719 — mod_lua Use of uninitialized value of in r:parsebody

msrc_CVE-2022-22719

OESA-2022-1596 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd, openEuler:20.03-LTS-SP3: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.(CVE-2022-23943) If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22721) Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling(CVE-2022-22720) A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.(CVE-2022-22719)

openSUSE-SU-2022:1031-1 — Security update for apache2

Security update for apache2

RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

SUSE-SU-2022:0918-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2022-22719

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.