CVSS: 7.1EPSS: 0%CPEs: 15EXPL: 2CVE-2009-1891 – httpd: possible temporary DoS (CPU consumption) in mod_deflate
https://notcve.org/view.php?id=CVE-2009-1891
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption). El módulo mod_deflate en Apache httpd v2.2.11 y anteriores comprime archivos de gran tamaño hasta finalizar incluso después de que la conexión de red asociada está cerrada, lo cual permite a atacantes remotos provocar una denegación de servicio (consumo de CPU). • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2 http://marc.info/?l=apache-httpd-dev&m=124661528519546&w=2 http://marc.info/?l=bugtraq&m=129190899612998&w=2 http://marc.info/? • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.1EPSS: 2%CPEs: 14EXPL: 0CVE-2009-1890 – httpd: mod_proxy reverse proxy DoS (infinite loop)
https://notcve.org/view.php?id=CVE-2009-1890
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests. La función stream_reqbody_cl de mod_proxy_http.c en el módulo mod_proxy del Servidor HTTP de Apache anterior a v2.3.3, cuando está configurado un proxy inverso, no maneja adecuadamente un flujo de datos que exceda el valor de Content-Length (Longitud del Contenido), esto permite a atacantes remotos provocar una denegación de servicio (consumo de la CPU) a través de una solicitud manipulada. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html http://marc.info/?l=bugtraq&m=129190899612998&w=2 http://osvdb.org/55553 http://secunia.com/advisories/35691 http://secunia.com/advisories/35721 http://secunia.com/advisories/35793 http://secunia.com/advisories/35865 http://secunia.com/advisories/37152 http://secunia.com/advisories/37221 http://security.gentoo.org/glsa/glsa-2009 • CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.4EPSS: 38%CPEs: 6EXPL: 2CVE-2009-1956 – apr-util single NULL byte buffer overflow
https://notcve.org/view.php?id=CVE-2009-1956
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input. Error de superación de límite (off-by-one) en la función apr_brigade_vprintf de Apache APR-util anterior a v1.3.5 en plataformas big-endian, permite a atacantes remotos obtener información sensible o provocar una denegación de servicio (caída de la aplicación) a través de una entrada manipulada. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://marc.info/?l=bugtraq&m=129190899612998&w=2 http://secunia.com/advisories/34724 http://secunia.com/advisories/35284 http://secunia.com/advisories/35395 http://secunia.com/advisories/35487 http://secunia.com/advisories/35565 http://secunia.com/advisories/35710 http://secunia.com/advisories/35797 http://secunia.com/advisories/35843 http://secunia.com/advisories/37221 http://security.gentoo.org/g • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 19%CPEs: 13EXPL: 1CVE-2009-1955 – Apache mod_dav / svn - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-1955
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564. El parseador XML en el interfaz apr_xml_* en xml/apr_xml.c en Apache APR-util anteriores a v1.3.7 tal y como es utilizado en los módulos mod_dav y mod_dav_svn en el servidor HTTP de Apache, permite a atacantes remotos producir una denegación de servicio (agotamiento de memoria) a través de un documento XML manipulado que contiene un gran numero de referencias anidadas, como se demostró en la petición PROPFIND, una vulnerabilidad similar a CVE-2003-1564. • https://www.exploit-db.com/exploits/8842 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html http://marc.info/?l=apr-dev&m=124396021826125&w=2 http://marc.info/?l=bugtraq&m=129190899612998&w=2 http://secunia.com/advisories/34724 http://secunia.com/advisories/35284 http://secunia.com/advisories/35360 http://secunia.com/advisories/35395 http://secunia.com/advisories/35444 http: • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 4.3EPSS: 3%CPEs: 22EXPL: 0CVE-2009-0023 – apr-util heap buffer underwrite
https://notcve.org/view.php?id=CVE-2009-0023
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow. La función apr_strmatch_precompile en strmatch/apr_strmatch.c en Apache APR-util anteriores a v1.3.5 permite a los atacantes remotos causar una denegación de servicio (caída del demonio) a través de una entrada manipulada en 1) un fichero .htaccess utilizado con el Servidor Apache HTTP, (2) la directiva SVNMasterURI en el módulo mod_dav_svn en el Servidor Apache HTTP, (3) el módulo mod_apreq2 para el Servidor Apache HTTP, o (4) una aplicación que utiliza la librería libapreq2, relativa a un "bandera de desbordamiento inferior". • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://marc.info/?l=bugtraq&m=129190899612998&w=2 http://secunia.com/advisories/34724 http://secunia.com/advisories/35284 http://secunia.com/advisories/35360 http://secunia.com/advisories/35395 http://secunia.com/advisories/35444 http://secunia.com/advisories/35487 http://secunia.com/advisories/35565 http://secunia.com/advisories/35710 http://secunia.com/advisories/35797 http://secunia.com/advisories&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •