Vulnerability in Apache HTTP Server
CVE-2015-0253
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
EPSS: 0.147 (96.3th percentile) — read the EPSS interpretation.
Affected products
- Apache Http_server — versions 2.4.12
- Apple Mac_os_x — versions 10.10.4
- Apple Mac_os_x_server — versions 5.0.3
- Oracle Linux — versions 7
- Oracle Solaris — versions 11.3
- N/a — versions n/a
References
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (vendor-advisory, x_refsource_APPLE, Mailing List)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)