CVE-2007-3947 request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location...
MediumCVSS 5.8
EPSS 8.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lighttpd | <= 1.4.15 | No fix listed |
| debian/lighttpd(Debian:12) | < 1.4.16-1 | 1.4.16-1 |
| debian/lighttpd(Debian:13) | < 1.4.16-1 | 1.4.16-1 |
| debian/lighttpd(Debian:14) | < 1.4.16-1 | 1.4.16-1 |
References
- 38313 vdb-entry
- 26130 third-party-advisory vendor-advisory
- 26158 third-party-advisory vendor-advisory
- 26505 third-party-advisory
- 26593 third-party-advisory
- GLSA-200708-11 vendor-advisory
- trac.lighttpd.net
- trac.lighttpd.net
- DSA-1362 vendor-advisory
- SUSE-SR:2007:015 vendor-advisory
- 20070719 rPSA-2007-0145-1 lighttpd mailing-list
- 24967 vdb-entry
- ADV-2007-2585 vdb-entry
- Debian Security Tracker CVE-2007-3947 vendor-advisory
- bugs.debian.org issue-tracking