{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated mod_proxy_fcgi package that fixes one security issue is now\navailable for Red Hat Ceph Storage 1.2 for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nAll mod_proxy_fcgi users are advised to upgrade to this updated package,\nwhich corrects this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1855",
        "url": "https://access.redhat.com/errata/RHSA-2015:1855"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1855.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:37+00:00",
      "generator": {
        "date": "2024-11-14T14:34:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1855",
      "initial_release_date": "2015-10-01T20:25:42+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Common for RHEL Server (v. 6)",
                "product": {
                  "name": "Red Hat Common for RHEL Server (v. 6)",
                  "product_id": "6Server-RH-Common",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_common:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Common"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi-debuginfo@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
          "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T20:25:42+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1855"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mod_proxy_fcgi and ceph packages that fix one security issue and\nseveral bugs are now available for CentOS 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nThis update also fixes the following bugs:\n\n* The RADOS gateway (RGW) can now properly decode the slash characters\n(\"/\") in clients\u0027 upload IDs. (BZ#1183182)\n\n* The RGW\u0027s object attribute updates could race with other object updates\noperations, which led to inconsistent object states, such as incomplete\nobject deletions. RGW now handles attribute updates correctly. (BZ#1206963)\n\n* Recreating a previously existing bucket in RGW did not remove the bucket\ninstance metadata object and created a redundant object in the RGW pool.\nThe redundant objects are no longer generated. (BZ#1212524)\n\n* The Content-Length header is now correctly created when creating a\ncontainer using the Swift API. (BZ#1213988)\n\n* RGW did not properly cache users\u0027 keystone tokens and validated all\nkeystone tokens for every Swift operation. RGW now caches tokens correctly,\nso that the token validation occurs only when necessary. (BZ#1213999)\n\n* Modifying a user\u0027s Access Control List (ACL) permissions for an object in\nRGW inappropriately caused the user to become the owner of the object.\nThis update fixes this bug. (BZ#1214051)\n\n* RGW could fail to update the bucket attributes during a Swift API \"POST\"\noperation. RGW now correctly updates the bucket attributes. (BZ#1214058)\n\n* RGW no longer terminated unexpectedly when using keystone authentication\nto copy an object. (BZ#1214061)\n\n* An attempt to download an object greater than 512 KB using a range header\nfailed when using the Swift API. Objects can now be downloaded as expected.\n(BZ#1214854)\n\n* When using OpenStack\u0027s Cinder RADOS Block Device (RBD) back-end driver\nwith Ceph administration socket enabled, Ceph could leak file descriptors\nand eventually consume the maximum number of allowed opened files.\nThis behavior caused Cinder\u0027s RBD connections to fail. Now, Ceph closes the\nadministration socket appropriately. (BZ#1220496)\n\n* When a part of a multi-part object was resent, the object became broken\ndue a discrepancy between the object size when listing the object and when\nstating the object. Now, multi-part objects no longer become broken in such\na case. (BZ#1222091)\n\n* When the number of placement groups (PGs) in a pool was increased, Ceph\ndid not send watch or notify operations correctly. Consequently, the librbd\nlibrary presented inconsistent RBD snapshot data. Now, Ceph correctly\nre-sends operations. (BZ#1245785)\n\n* When reopening log files, Object Storage Devices (OSDs) could write data\nto the incorrect file descriptor. Consequently, log entries were lost, or\nwere written to a file descriptor, which was opened by the filestore.\nThe latter case could cause data corruption. This bug has been fixed.\n(BZ#1247752)\n\nAll mod_proxy_fcgi and ceph users are advised to upgrade to these updated\npackages, which correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1858",
        "url": "https://access.redhat.com/errata/RHSA-2015:1858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1560193",
        "url": "https://access.redhat.com/articles/1560193"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1372203",
        "url": "https://access.redhat.com/articles/1372203"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1858.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi and ceph security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:27+00:00",
      "generator": {
        "date": "2024-11-14T14:34:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1858",
      "initial_release_date": "2015-10-01T21:00:50+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T21:00:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-02-02T22:02:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 1.2 for CentOS",
                "product": {
                  "name": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_id": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:1.2::centos:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 1.2 for CentOS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T21:00:50+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nRefer to the following Knowledge Base article for a download link and\nsigning information:\n\nhttps://access.redhat.com/articles/1560193",
          "product_ids": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1858"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mod_proxy_fcgi and ceph packages that fix one security issue and\nseveral bugs are now available for CentOS 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nThis update also fixes the following bugs:\n\n* The RADOS gateway (RGW) can now properly decode the slash characters\n(\"/\") in clients\u0027 upload IDs. (BZ#1183182)\n\n* The RGW\u0027s object attribute updates could race with other object updates\noperations, which led to inconsistent object states, such as incomplete\nobject deletions. RGW now handles attribute updates correctly. (BZ#1206963)\n\n* Recreating a previously existing bucket in RGW did not remove the bucket\ninstance metadata object and created a redundant object in the RGW pool.\nThe redundant objects are no longer generated. (BZ#1212524)\n\n* The Content-Length header is now correctly created when creating a\ncontainer using the Swift API. (BZ#1213988)\n\n* RGW did not properly cache users\u0027 keystone tokens and validated all\nkeystone tokens for every Swift operation. RGW now caches tokens correctly,\nso that the token validation occurs only when necessary. (BZ#1213999)\n\n* Modifying a user\u0027s Access Control List (ACL) permissions for an object in\nRGW inappropriately caused the user to become the owner of the object.\nThis update fixes this bug. (BZ#1214051)\n\n* RGW could fail to update the bucket attributes during a Swift API \"POST\"\noperation. RGW now correctly updates the bucket attributes. (BZ#1214058)\n\n* RGW no longer terminated unexpectedly when using keystone authentication\nto copy an object. (BZ#1214061)\n\n* An attempt to download an object greater than 512 KB using a range header\nfailed when using the Swift API. Objects can now be downloaded as expected.\n(BZ#1214854)\n\n* When using OpenStack\u0027s Cinder RADOS Block Device (RBD) back-end driver\nwith Ceph administration socket enabled, Ceph could leak file descriptors\nand eventually consume the maximum number of allowed opened files.\nThis behavior caused Cinder\u0027s RBD connections to fail. Now, Ceph closes the\nadministration socket appropriately. (BZ#1220496)\n\n* When a part of a multi-part object was resent, the object became broken\ndue a discrepancy between the object size when listing the object and when\nstating the object. Now, multi-part objects no longer become broken in such\na case. (BZ#1222091)\n\n* When the number of placement groups (PGs) in a pool was increased, Ceph\ndid not send watch or notify operations correctly. Consequently, the librbd\nlibrary presented inconsistent RBD snapshot data. Now, Ceph correctly\nre-sends operations. (BZ#1245785)\n\n* When reopening log files, Object Storage Devices (OSDs) could write data\nto the incorrect file descriptor. Consequently, log entries were lost, or\nwere written to a file descriptor, which was opened by the filestore.\nThe latter case could cause data corruption. This bug has been fixed.\n(BZ#1247752)\n\nAll mod_proxy_fcgi and ceph users are advised to upgrade to these updated\npackages, which correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1858",
        "url": "https://access.redhat.com/errata/RHSA-2015:1858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1560193",
        "url": "https://access.redhat.com/articles/1560193"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1372203",
        "url": "https://access.redhat.com/articles/1372203"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1858.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi and ceph security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:27+00:00",
      "generator": {
        "date": "2024-11-14T14:34:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1858",
      "initial_release_date": "2015-10-01T21:00:50+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T21:00:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-02-02T22:02:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 1.2 for CentOS",
                "product": {
                  "name": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_id": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:1.2::centos:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 1.2 for CentOS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T21:00:50+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nRefer to the following Knowledge Base article for a download link and\nsigning information:\n\nhttps://access.redhat.com/articles/1560193",
          "product_ids": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1858"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated mod_proxy_fcgi package that fixes one security issue is now\navailable for Red Hat Ceph Storage 1.2 for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nAll mod_proxy_fcgi users are advised to upgrade to this updated package,\nwhich corrects this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1855",
        "url": "https://access.redhat.com/errata/RHSA-2015:1855"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1855.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:37+00:00",
      "generator": {
        "date": "2024-11-14T14:34:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1855",
      "initial_release_date": "2015-10-01T20:25:42+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Common for RHEL Server (v. 6)",
                "product": {
                  "name": "Red Hat Common for RHEL Server (v. 6)",
                  "product_id": "6Server-RH-Common",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_common:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Common"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi-debuginfo@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
          "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T20:25:42+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1855"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated mod_proxy_fcgi package that fixes one security issue is now\navailable for Red Hat Ceph Storage 1.2 for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nAll mod_proxy_fcgi users are advised to upgrade to this updated package,\nwhich corrects this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1855",
        "url": "https://access.redhat.com/errata/RHSA-2015:1855"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1855.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi security update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:37+00:00",
      "generator": {
        "date": "2024-11-14T14:34:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1855",
      "initial_release_date": "2015-10-01T20:25:42+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-10-01T20:25:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Common for RHEL Server (v. 6)",
                "product": {
                  "name": "Red Hat Common for RHEL Server (v. 6)",
                  "product_id": "6Server-RH-Common",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_common:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Common"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi-debuginfo@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                "product": {
                  "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_id": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_proxy_fcgi@2.4.10-5.20150415gitd45a11f.el6cp?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64 as a component of Red Hat Common for RHEL Server (v. 6)",
          "product_id": "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        },
        "product_reference": "mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
        "relates_to_product_reference": "6Server-RH-Common"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
          "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
          "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T20:25:42+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1855"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.src",
            "6Server-RH-Common:mod_proxy_fcgi-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64",
            "6Server-RH-Common:mod_proxy_fcgi-debuginfo-0:2.4.10-5.20150415gitd45a11f.el6cp.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mod_proxy_fcgi and ceph packages that fix one security issue and\nseveral bugs are now available for CentOS 6.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices.\n\nThe mod_proxy_fcgi package provides a proxy module for the Apache 2.2 HTTP\nserver.\n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nThis update also fixes the following bugs:\n\n* The RADOS gateway (RGW) can now properly decode the slash characters\n(\"/\") in clients\u0027 upload IDs. (BZ#1183182)\n\n* The RGW\u0027s object attribute updates could race with other object updates\noperations, which led to inconsistent object states, such as incomplete\nobject deletions. RGW now handles attribute updates correctly. (BZ#1206963)\n\n* Recreating a previously existing bucket in RGW did not remove the bucket\ninstance metadata object and created a redundant object in the RGW pool.\nThe redundant objects are no longer generated. (BZ#1212524)\n\n* The Content-Length header is now correctly created when creating a\ncontainer using the Swift API. (BZ#1213988)\n\n* RGW did not properly cache users\u0027 keystone tokens and validated all\nkeystone tokens for every Swift operation. RGW now caches tokens correctly,\nso that the token validation occurs only when necessary. (BZ#1213999)\n\n* Modifying a user\u0027s Access Control List (ACL) permissions for an object in\nRGW inappropriately caused the user to become the owner of the object.\nThis update fixes this bug. (BZ#1214051)\n\n* RGW could fail to update the bucket attributes during a Swift API \"POST\"\noperation. RGW now correctly updates the bucket attributes. (BZ#1214058)\n\n* RGW no longer terminated unexpectedly when using keystone authentication\nto copy an object. (BZ#1214061)\n\n* An attempt to download an object greater than 512 KB using a range header\nfailed when using the Swift API. Objects can now be downloaded as expected.\n(BZ#1214854)\n\n* When using OpenStack\u0027s Cinder RADOS Block Device (RBD) back-end driver\nwith Ceph administration socket enabled, Ceph could leak file descriptors\nand eventually consume the maximum number of allowed opened files.\nThis behavior caused Cinder\u0027s RBD connections to fail. Now, Ceph closes the\nadministration socket appropriately. (BZ#1220496)\n\n* When a part of a multi-part object was resent, the object became broken\ndue a discrepancy between the object size when listing the object and when\nstating the object. Now, multi-part objects no longer become broken in such\na case. (BZ#1222091)\n\n* When the number of placement groups (PGs) in a pool was increased, Ceph\ndid not send watch or notify operations correctly. Consequently, the librbd\nlibrary presented inconsistent RBD snapshot data. Now, Ceph correctly\nre-sends operations. (BZ#1245785)\n\n* When reopening log files, Object Storage Devices (OSDs) could write data\nto the incorrect file descriptor. Consequently, log entries were lost, or\nwere written to a file descriptor, which was opened by the filestore.\nThe latter case could cause data corruption. This bug has been fixed.\n(BZ#1247752)\n\nAll mod_proxy_fcgi and ceph users are advised to upgrade to these updated\npackages, which correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:1858",
        "url": "https://access.redhat.com/errata/RHSA-2015:1858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1560193",
        "url": "https://access.redhat.com/articles/1560193"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1372203",
        "url": "https://access.redhat.com/articles/1372203"
      },
      {
        "category": "external",
        "summary": "1163555",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1858.json"
      }
    ],
    "title": "Red Hat Security Advisory: mod_proxy_fcgi and ceph security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T14:34:27+00:00",
      "generator": {
        "date": "2024-11-14T14:34:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2015:1858",
      "initial_release_date": "2015-10-01T21:00:50+00:00",
      "revision_history": [
        {
          "date": "2015-10-01T21:00:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-02-02T22:02:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:34:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 1.2 for CentOS",
                "product": {
                  "name": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_id": "Red Hat Ceph Storage 1.2 for CentOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:1.2::centos:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3583",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2014-10-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1163555"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers() function. A malicious FastCGI server that httpd is configured to connect to could send a carefully crafted response that would cause an httpd child process handling the request to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_proxy_fcgi handle_headers() buffer over read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Software Collections 1, Red Hat JBoss Web Server 1 and 2, and Red Hat JBoss Enterprise Application Platform 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 1.2 for CentOS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "RHBZ#1163555",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2014-10-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-10-01T21:00:50+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nRefer to the following Knowledge Base article for a download link and\nsigning information:\n\nhttps://access.redhat.com/articles/1560193",
          "product_ids": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:1858"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Ceph Storage 1.2 for CentOS"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: mod_proxy_fcgi handle_headers() buffer over read"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2014-3583",
    "description": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.",
    "id": "GSD-2014-3583",
    "references": [
      "https://www.suse.com/security/cve/CVE-2014-3583.html",
      "https://access.redhat.com/errata/RHSA-2015:1858",
      "https://access.redhat.com/errata/RHSA-2015:1855",
      "https://ubuntu.com/security/CVE-2014-3583",
      "https://alas.aws.amazon.com/cve/html/CVE-2014-3583.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-3583"
      ],
      "details": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.",
      "id": "GSD-2014-3583",
      "modified": "2023-12-13T01:22:53.568673Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2014-3583",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
            "refsource": "CONFIRM",
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
          },
          {
            "name": "USN-2523-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-2523-1"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
          },
          {
            "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818",
            "refsource": "CONFIRM",
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
          },
          {
            "name": "APPLE-SA-2015-08-13-2",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
          },
          {
            "name": "RHSA-2015:1855",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1855.html"
          },
          {
            "name": "71657",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/71657"
          },
          {
            "name": "https://support.apple.com/kb/HT205031",
            "refsource": "CONFIRM",
            "url": "https://support.apple.com/kb/HT205031"
          },
          {
            "name": "APPLE-SA-2015-09-16-4",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
          },
          {
            "name": "RHSA-2015:1858",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2015:1858"
          },
          {
            "name": "https://support.apple.com/HT205219",
            "refsource": "CONFIRM",
            "url": "https://support.apple.com/HT205219"
          },
          {
            "name": "GLSA-201701-36",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201701-36"
          },
          {
            "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:os_x_server:5.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.9.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-3583"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
            },
            {
              "name": "71657",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/71657"
            },
            {
              "name": "USN-2523-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-2523-1"
            },
            {
              "name": "APPLE-SA-2015-08-13-2",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
            },
            {
              "name": "https://support.apple.com/kb/HT205031",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://support.apple.com/kb/HT205031"
            },
            {
              "name": "APPLE-SA-2015-09-16-4",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
            },
            {
              "name": "https://support.apple.com/HT205219",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://support.apple.com/HT205219"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
            },
            {
              "name": "RHSA-2015:1855",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1855.html"
            },
            {
              "name": "GLSA-201701-36",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/201701-36"
            },
            {
              "name": "RHSA-2015:1858",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2015:1858"
            },
            {
              "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2021-06-06T11:15Z",
      "publishedDate": "2014-12-15T18:59Z"
    }
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3583"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-12-15T18:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.",
  "id": "GHSA-jh98-gwvf-4vf3",
  "modified": "2022-05-13T01:09:46Z",
  "published": "2022-05-13T01:09:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3583"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT205031"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT205219"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201701-36"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2015:1858"
    },
    {
      "type": "WEB",
      "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1855.html"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/71657"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2523-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201412-0516",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "http server",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "apache",
        "version": "2.4.10"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "apple",
        "version": "10.9.5"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "12.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "14.10"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "10.04"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.2"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.4"
      },
      {
        "model": "os x server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "5.0.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.1"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.0"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.10 to  10.10.4"
      },
      {
        "model": "macos server",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "apple",
        "version": "5.0.3   (os x yosemite v10.10.5 or later )"
      },
      {
        "model": "enterprise manager",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "ops center 12.1.4"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "ops center 12.2.0"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "ops center 12.2.1"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "ops center 12.3.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.10"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "14.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "14.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.37"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.0"
      },
      {
        "model": "software collections for rhel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "170"
      },
      {
        "model": "software collections for rhel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "160"
      },
      {
        "model": "common for rhel server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.0.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "11.1.3"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x4.1.5"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x3.2.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x3.2.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x3.1.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x4.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x4.0"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x3.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x3.0"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.9.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.10"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.4"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.9"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.8"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.7"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.6"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.3"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.2"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.3"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.2.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.2"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.4"
      },
      {
        "model": "mac os server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x5.0.3"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.5"
      },
      {
        "model": "apache",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.11"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.9.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:os_x_server:5.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Teguh P. Alko",
    "sources": [
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2014-3583",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2014-3583",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-71523",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-3583",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201412-332",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-71523",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-3583",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers. Apache HTTP Server is prone to a remote denial-of-service vulnerability. \nA remote attacker may exploit this issue to trigger denial-of-service conditions. \nVersions prior to Apache HTTP Server 2.4.11 are vulnerable. The server is fast, reliable and extensible through a simple API. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201701-36\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: Apache: Multiple vulnerabilities\n     Date: January 15, 2017\n     Bugs: #529130, #589226, #601736, #603130\n       ID: 201701-36\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Apache, the worst of which\ncould lead to a Denial of Service condition. Please review\nthe CVE identifiers, upstream Apache Software Foundation documentation,\nand HTTPoxy website referenced below for details. \nAdditionally, an attacker could intercept unsecured (HTTP)\ntransmissions via the HTTPoxy vulnerability. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Apache users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-servers/apache-2.4.25\"\n\nReferences\n==========\n\n[ 1 ] Apache Software Foundation Projects and \"httpoxy\" CERT VU #797896\n      https://www.apache.org/security/asf-httpoxy-response.txt\n[ 2 ] CVE-2014-3583\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3583\n[ 3 ] CVE-2016-0736\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0736\n[ 4 ] CVE-2016-2161\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2161\n[ 5 ] CVE-2016-5387\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5387\n[ 6 ] CVE-2016-8073\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8073\n[ 7 ] CVE-2016-8740\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8740\n[ 8 ] CVE-2016-8743\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8743\n[ 9 ] HTTPoxy Website\n      https://httpoxy.org/\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201701-36\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2017 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update\n2015-006\n\nOS X Yosemite v10.10.5 and Security Update 2015-006 is now available\nand addresses the following:\n\napache\nAvailable for:  OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in Apache 2.4.16, the most\nserious of which may allow a remote attacker to cause a denial of\nservice. These were addressed by updating Apache to version\n2.4.16. \nCVE-ID\nCVE-2014-3581\nCVE-2014-3583\nCVE-2014-8109\nCVE-2015-0228\nCVE-2015-0253\nCVE-2015-3183\nCVE-2015-3185\n\napache_mod_php\nAvailable for:  OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in PHP 5.5.20, the most\nserious of which may lead to arbitrary code execution. \nDescription:  Multiple vulnerabilities existed in PHP versions prior\nto 5.5.20. These were addressed by updating Apache to version 5.5.27. \nCVE-ID\nCVE-2015-2783\nCVE-2015-2787\nCVE-2015-3307\nCVE-2015-3329\nCVE-2015-3330\nCVE-2015-4021\nCVE-2015-4022\nCVE-2015-4024\nCVE-2015-4025\nCVE-2015-4026\nCVE-2015-4147\nCVE-2015-4148\n\nApple ID OD Plug-in\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able change the password of a\nlocal user\nDescription:  In some circumstances, a state management issue existed\nin password authentication. The issue was addressed through improved\nstate management. \nCVE-ID\nCVE-2015-3799 : an anonymous researcher working with HP\u0027s Zero Day\nInitiative\n\nAppleGraphicsControl\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to determine kernel\nmemory layout\nDescription:  An issue existed in AppleGraphicsControl which could\nhave led to the disclosure of kernel memory layout. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2015-5768 : JieTao Yang of KeenTeam\n\nBluetooth\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue existed in\nIOBluetoothHCIController. This issue was addressed through improved\nmemory handling. \nCVE-ID\nCVE-2015-3779 : Teddy Reed of Facebook Security\n\nBluetooth\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to determine kernel\nmemory layout\nDescription:  A memory management issue could have led to the\ndisclosure of kernel memory layout. This issue was addressed with\nimproved memory management. \nCVE-ID\nCVE-2015-3780 : Roberto Paleari and Aristide Fattori of Emaze\nNetworks\n\nBluetooth\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious app may be able to access notifications from\nother iCloud devices\nDescription:  An issue existed where a malicious app could access a\nBluetooth-paired Mac or iOS device\u0027s Notification Center\nnotifications via the Apple Notification Center Service. The issue\naffected devices using Handoff and logged into the same iCloud\naccount. This issue was resolved by revoking access to the Apple\nNotification Center Service. \nCVE-ID\nCVE-2015-3786 : Xiaolong Bai (Tsinghua University), System Security\nLab (Indiana University), Tongxin Li (Peking University), XiaoFeng\nWang (Indiana University)\n\nBluetooth\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  An attacker with privileged network position may be able to\nperform denial of service attack using malformed Bluetooth packets\nDescription:  An input validation issue existed in parsing of\nBluetooth ACL packets. This issue was addressed through improved\ninput validation. \nCVE-ID\nCVE-2015-3787 : Trend Micro\n\nBluetooth\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription:  Multiple buffer overflow issues existed in blued\u0027s\nhandling of XPC messages. These issues were addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2015-3777 : mitp0sh of [PDX]\n\nbootp\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious Wi-Fi network may be able to determine networks\na device has previously accessed\nDescription:  Upon connecting to a Wi-Fi network, iOS may have\nbroadcast MAC addresses of previously accessed networks via the DNAv4\nprotocol. This issue was addressed through disabling DNAv4 on\nunencrypted Wi-Fi networks. \nCVE-ID\nCVE-2015-3778 : Piers O\u0027Hanlon of Oxford Internet Institute,\nUniversity of Oxford (on the EPSRC Being There project)\n\nCloudKit\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to access the iCloud\nuser record of a previously signed in user\nDescription:  A state inconsistency existed in CloudKit when signing\nout users. This issue was addressed through improved state handling. \nCVE-ID\nCVE-2015-3782 : Deepkanwal Plaha of University of Toronto\n\nCoreMedia Playback\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  Memory corruption issues existed in CoreMedia Playback. \nThese were addressed through improved memory handling. \nCVE-ID\nCVE-2015-5777 : Apple\nCVE-2015-5778 : Apple\n\nCoreText\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted font file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team\n\nCoreText\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted font file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team\n\ncurl\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities in cURL and libcurl prior to\n7.38.0, one of which may allow remote attackers to bypass the Same\nOrigin Policy. \nDescription:  Multiple vulnerabilities existed in cURL and libcurl\nprior to 7.38.0. These issues were addressed by updating cURL to\nversion 7.43.0. \nCVE-ID\nCVE-2014-3613\nCVE-2014-3620\nCVE-2014-3707\nCVE-2014-8150\nCVE-2014-8151\nCVE-2015-3143\nCVE-2015-3144\nCVE-2015-3145\nCVE-2015-3148\nCVE-2015-3153\n\nData Detectors Engine\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a sequence of unicode characters can lead to an\nunexpected application termination or arbitrary code execution\nDescription:  Memory corruption issues existed in processing of\nUnicode characters. These issues were addressed through improved\nmemory handling. \nCVE-ID\nCVE-2015-5750 : M1x7e1 of Safeye Team (www.safeye.org)\n\nDate \u0026 Time pref pane\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Applications that rely on system time may have unexpected\nbehavior\nDescription:  An authorization issue existed when modifying the\nsystem date and time preferences. This issue was addressed with\nadditional authorization checks. \nCVE-ID\nCVE-2015-3757 : Mark S C Smith\n\nDictionary Application\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  An attacker with a privileged network position may be able\nto intercept users\u0027 Dictionary app queries\nDescription:  An issue existed in the Dictionary app, which did not\nproperly secure user communications. This issue was addressed by\nmoving Dictionary queries to HTTPS. \nCVE-ID\nCVE-2015-3774 : Jeffrey Paul of EEQJ, Jan Bee of the Google Security\nTeam\n\nDiskImages\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted DMG file may lead to an\nunexpected application termination or arbitrary code execution with\nsystem privileges\nDescription:  A memory corruption issue existed in parsing of\nmalformed DMG images. This issue was addressed through improved\nmemory handling. \nCVE-ID\nCVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team\n\ndyld\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A path validation issue existed in dyld. This was\naddressed through improved environment sanitization. \nCVE-ID\nCVE-2015-3760 : beist of grayhash, Stefan Esser\n\nFontParser\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted font file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-3804 : Apple\nCVE-2015-5775 : Apple\n\nFontParser\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted font file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-5756 : John Villamil (@day6reak), Yahoo Pentest Team\n\ngroff\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple issues in pdfroff\nDescription:  Multiple issues existed in pdfroff, the most serious of\nwhich may allow arbitrary filesystem modification. These issues were\naddressed by removing pdfroff. \nCVE-ID\nCVE-2009-5044\nCVE-2009-5078\n\nImageIO\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted TIFF image may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nTIFF images. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2015-5758 : Apple\n\nImageIO\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Visiting a maliciously crafted website may result in the\ndisclosure of process memory\nDescription:  An uninitialized memory access issue existed in\nImageIO\u0027s handling of PNG and TIFF images. Visiting a malicious\nwebsite may result in sending data from process memory to the\nwebsite. This issue is addressed through improved memory\ninitialization and additional validation of PNG and TIFF images. \nCVE-ID\nCVE-2015-5781 : Michal Zalewski\nCVE-2015-5782 : Michal Zalewski\n\nInstall Framework Legacy\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with root privileges\nDescription:  An issue existed in how Install.framework\u0027s \u0027runner\u0027\nbinary dropped privileges. This issue was addressed through improved\nprivilege management. \nCVE-ID\nCVE-2015-5784 : Ian Beer of Google Project Zero\n\nInstall Framework Legacy\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A race condition existed in\nInstall.framework\u0027s \u0027runner\u0027 binary that resulted in\nprivileges being incorrectly dropped. This issue was addressed\nthrough improved object locking. \nCVE-ID\nCVE-2015-5754 : Ian Beer of Google Project Zero\n\nIOFireWireFamily\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  Memory corruption issues existed in IOFireWireFamily. \nThese issues were addressed through additional type input validation. \nCVE-ID\nCVE-2015-3769 : Ilja van Sprundel\nCVE-2015-3771 : Ilja van Sprundel\nCVE-2015-3772 : Ilja van Sprundel\n\nIOGraphics\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A memory corruption issue existed in IOGraphics. This\nissue was addressed through additional type input validation. \nCVE-ID\nCVE-2015-3770 : Ilja van Sprundel\nCVE-2015-5783 : Ilja van Sprundel\n\nIOHIDFamily\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A buffer overflow issue existed in IOHIDFamily. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5774 : TaiG Jailbreak Team\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to determine kernel\nmemory layout\nDescription:  An issue existed in the mach_port_space_info interface,\nwhich could have led to the disclosure of kernel memory layout. This\nwas addressed by disabling the mach_port_space_info interface. \nCVE-ID\nCVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team,\n@PanguTeam\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  An integer overflow existed in the handling of IOKit\nfunctions. This issue was addressed through improved validation of\nIOKit API arguments. \nCVE-ID\nCVE-2015-3768 : Ilja van Sprundel\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to cause a system denial of service\nDescription:  A resource exhaustion issue existed in the fasttrap\ndriver. This was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5747 : Maxime VILLARD of m00nbsd\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to cause a system denial of service\nDescription:  A validation issue existed in the mounting of HFS\nvolumes. This was addressed by adding additional checks. \nCVE-ID\nCVE-2015-5748 : Maxime VILLARD of m00nbsd\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute unsigned code\nDescription:  An issue existed that allowed unsigned code to be\nappended to signed code in a specially crafted executable file. This\nissue was addressed through improved code signature validation. \nCVE-ID\nCVE-2015-3806 : TaiG Jailbreak Team\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A specially crafted executable file could allow unsigned,\nmalicious code to execute\nDescription:  An issue existed in the way multi-architecture\nexecutable files were evaluated that could have allowed unsigned code\nto be executed. This issue was addressed through improved validation\nof executable files. \nCVE-ID\nCVE-2015-3803 : TaiG Jailbreak Team\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute unsigned code\nDescription:  A validation issue existed in the handling of Mach-O\nfiles. This was addressed by adding additional checks. \nCVE-ID\nCVE-2015-3802 : TaiG Jailbreak Team\nCVE-2015-3805 : TaiG Jailbreak Team\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted plist may lead to an\nunexpected application termination or arbitrary code execution with\nsystem privileges\nDescription:  A memory corruption existed in processing of malformed\nplists. This issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein\n(@jollyjinx) of Jinx Germany\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A path validation issue existed. This was addressed\nthrough improved environment sanitization. \nCVE-ID\nCVE-2015-3761 : Apple\n\nLibc\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted regular expression may lead\nto an unexpected application termination or arbitrary code execution\nDescription:  Memory corruption issues existed in the TRE library. \nThese were addressed through improved memory handling. \nCVE-ID\nCVE-2015-3796 : Ian Beer of Google Project Zero\nCVE-2015-3797 : Ian Beer of Google Project Zero\nCVE-2015-3798 : Ian Beer of Google Project Zero\n\nLibinfo\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  A remote attacker may be able to cause unexpected\napplication termination or arbitrary code execution\nDescription:  Memory corruption issues existed in handling AF_INET6\nsockets. These were addressed by improved memory handling. \nCVE-ID\nCVE-2015-5776 : Apple\n\nlibpthread\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A memory corruption issue existed in handling syscalls. \nThis issue was addressed through improved lock state checking. \nCVE-ID\nCVE-2015-5757 : Lufeng Li of Qihoo 360\n\nlibxml2\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in libxml2 versions prior\nto 2.9.2, the most serious of which may allow a remote attacker to\ncause a denial of service\nDescription:  Multiple vulnerabilities existed in libxml2 versions\nprior to 2.9.2. These were addressed by updating libxml2 to version\n2.9.2. \nCVE-ID\nCVE-2012-6685 : Felix Groebert of Google\nCVE-2014-0191 : Felix Groebert of Google\n\nlibxml2\nAvailable for:  OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted XML document may lead to\ndisclosure of user information\nDescription:  A memory access issue existed in libxml2. This was\naddressed by improved memory handling\nCVE-ID\nCVE-2014-3660 : Felix Groebert of Google\n\nlibxml2\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted XML document may lead to\ndisclosure of user information\nDescription:  A memory corruption issue existed in parsing of XML\nfiles. This issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-3807 : Apple\n\nlibxpc\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A memory corruption issue existed in handling of\nmalformed XPC messages. This issue was improved through improved\nbounds checking. \nCVE-ID\nCVE-2015-3795 : Mathew Rowley\n\nmail_cmds\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary shell commands\nDescription:  A validation issue existed in the mailx parsing of\nemail addresses. This was addressed by improved sanitization. \nCVE-ID\nCVE-2014-7844\n\nNotification Center OSX\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A malicious application may be able to access all\nnotifications previously displayed to users\nDescription:  An issue existed in Notification Center, which did not\nproperly delete user notifications. This issue was addressed by\ncorrectly deleting notifications dismissed by users. \nCVE-ID\nCVE-2015-3764 : Jonathan Zdziarski\n\nntfs\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A memory corruption issue existed in NTFS. This issue\nwas addressed through improved memory handling. \nCVE-ID\nCVE-2015-5763 : Roberto Paleari and Aristide Fattori of Emaze\nNetworks\n\nOpenSSH\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Remote attackers may be able to circumvent a time delay for\nfailed login attempts and conduct brute-force attacks\nDescription:  An issue existed when processing keyboard-interactive\ndevices. This issue was addressed through improved authentication\nrequest validation. \nCVE-ID\nCVE-2015-5600\n\nOpenSSL\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in OpenSSL versions prior\nto 0.9.8zg, the most serious of which may allow a remote attacker to\ncause a denial of service. \nDescription:  Multiple vulnerabilities existed in OpenSSL versions\nprior to 0.9.8zg. These were addressed by updating OpenSSL to version\n0.9.8zg. \nCVE-ID\nCVE-2015-1788\nCVE-2015-1789\nCVE-2015-1790\nCVE-2015-1791\nCVE-2015-1792\n\nperl\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted regular expression may lead to\ndisclosure of unexpected application termination or arbitrary code\nexecution\nDescription:  An integer underflow issue existed in the way Perl\nparsed regular expressions. This issue was addressed through improved\nmemory handling. \nCVE-ID\nCVE-2013-7422\n\nPostgreSQL\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  An attacker may be able to cause unexpected application\ntermination or gain access to data without proper authentication\nDescription:  Multiple issues existed in PostgreSQL 9.2.4. These\nissues were addressed by updating PostgreSQL to 9.2.13. \nCVE-ID\nCVE-2014-0067\nCVE-2014-8161\nCVE-2015-0241\nCVE-2015-0242\nCVE-2015-0243\nCVE-2015-0244\n\npython\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in Python 2.7.6, the most\nserious of which may lead to arbitrary code execution\nDescription:  Multiple vulnerabilities existed in Python versions\nprior to 2.7.6. These were addressed by updating Python to version\n2.7.10. \nCVE-ID\nCVE-2013-7040\nCVE-2013-7338\nCVE-2014-1912\nCVE-2014-7185\nCVE-2014-9365\n\nQL Office\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted Office document may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in parsing of Office\ndocuments. This issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-5773 : Apple\n\nQL Office\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted XML file may lead to\ndisclosure of user information\nDescription:  An external entity reference issue existed in XML file\nparsing. This issue was addressed through improved parsing. \nCVE-ID\nCVE-2015-3784 : Bruno Morisson of INTEGRITY S.A. \n\nQuartz Composer Framework\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted QuickTime file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue existed in parsing of\nQuickTime files. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2015-5771 : Apple\n\nQuick Look\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Searching for a previously viewed website may launch the web\nbrowser and render that website\nDescription:  An issue existed where QuickLook had the capability to\nexecute JavaScript. The issue was addressed by disallowing execution\nof JavaScript. \nCVE-ID\nCVE-2015-3781 : Andrew Pouliot of Facebook, Anto Loyola of Qubole\n\nQuickTime 7\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  Multiple memory corruption issues existed in QuickTime. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2015-3772\nCVE-2015-3779\nCVE-2015-5753 : Apple\nCVE-2015-5779 : Apple\n\nQuickTime 7\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  Multiple memory corruption issues existed in QuickTime. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2015-3765 : Joe Burnett of Audio Poison\nCVE-2015-3788 : Ryan Pentney and Richard Johnson of Cisco Talos\nCVE-2015-3789 : Ryan Pentney and Richard Johnson of Cisco Talos\nCVE-2015-3790 : Ryan Pentney and Richard Johnson of Cisco Talos\nCVE-2015-3791 : Ryan Pentney and Richard Johnson of Cisco Talos\nCVE-2015-3792 : Ryan Pentney and Richard Johnson of Cisco Talos\nCVE-2015-5751 : WalkerFuz\n\nSceneKit\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Viewing a maliciously crafted Collada file may lead to\narbitrary code execution\nDescription:  A heap buffer overflow existed in SceneKit\u0027s handling\nof Collada files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-5772 : Apple\n\nSceneKit\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.4\nImpact:  A remote attacker may be able to cause unexpected\napplication termination or arbitrary code execution\nDescription:  A memory corruption issue existed in SceneKit. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-3783 : Haris Andrianakis of Google Security Team\n\nSecurity\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A standard user may be able to gain access to admin\nprivileges without proper authentication\nDescription:  An issue existed in handling of user authentication. \nThis issue was addressed through improved authentication checks. \nCVE-ID\nCVE-2015-3775 : [Eldon Ahrold]\n\nSMBClient\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  A remote attacker may be able to cause unexpected\napplication termination or arbitrary code execution\nDescription:  A memory corruption issue existed in the SMB client. \nThis issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-3773 : Ilja van Sprundel\n\nSpeech UI\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted unicode string with speech\nalerts enabled may lead to an unexpected application termination or\narbitrary code execution\nDescription:  A memory corruption issue existed in handling of\nUnicode strings. This issue was addressed by improved memory\nhandling. \nCVE-ID\nCVE-2015-3794 : Adam Greenbaum of Refinitive\n\nsudo\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in sudo versions prior to\n1.7.10p9, the most serious of which may allow an attacker access to\narbitrary files\nDescription:  Multiple vulnerabilities existed in sudo versions prior\nto 1.7.10p9. These were addressed by updating sudo to version\n1.7.10p9. \nCVE-ID\nCVE-2013-1775\nCVE-2013-1776\nCVE-2013-2776\nCVE-2013-2777\nCVE-2014-0106\nCVE-2014-9680\n\ntcpdump\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Multiple vulnerabilities existed in tcpdump 4.7.3, the most\nserious of which may allow a remote attacker to cause a denial of\nservice. \nDescription:  Multiple vulnerabilities existed in tcpdump versions\nprior to 4.7.3. These were addressed by updating tcpdump to version\n4.7.3. \nCVE-ID\nCVE-2014-8767\nCVE-2014-8769\nCVE-2014-9140\n\nText Formats\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Parsing a maliciously crafted text file may lead to\ndisclosure of user information\nDescription:  An XML external entity reference issue existed with\nTextEdit parsing. This issue was addressed through improved parsing. \nCVE-ID\nCVE-2015-3762 : Xiaoyong Wu of the Evernote Security Team\n\nudf\nAvailable for:  OS X Yosemite v10.10 to v10.10.4\nImpact:  Processing a maliciously crafted DMG file may lead to an\nunexpected application termination or arbitrary code execution with\nsystem privileges\nDescription:  A memory corruption issue existed in parsing of\nmalformed DMG images. This issue was addressed through improved\nmemory handling. \nCVE-ID\nCVE-2015-3767 : beist of grayhash\n\nOS X Yosemite v10.10.5 includes the security content of Safari 8.0.8:\nhttps://support.apple.com/en-us/HT205033\n\nOS X Yosemite 10.10.5 and Security Update 2015-006 may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n\n\n-----BEGIN PGP SIGNATURE-----\n\niQIcBAEBCAAGBQJVzM3+AAoJEBcWfLTuOo7tx/YP/RTsUUx0UTk7rXj6AEcHmiR4\nY2xTUOXqRmxhieSbsGK9laKL5++lIzkGh5RC7oYag0+OgWtZz+EU/EtdoEJmGNJ6\n+PgoEnizYdKhO1kos1KCHOwG6UFCqoeEm6Icm33nVUqWp7uAmhVRMRxtMJEScLSR\n2LpsK0grIhFXtJGqu053TSKSCa1UTab8XWteZTT84uFGMSKbAFONj5CPIrR6+uev\nQpVTwrnskPDBOXJwGhjypvIBTbt2aa1wjCukOAWFHwf7Pma/QUdhKRkUK4vAb9/k\nfu2t2fBOvSMguJHRO+340NsQR9LvmdruBeAyNUH64srF1jtbAg0QnvZsPyO5aIyR\nA8WrzHl3oIc0II0y7VpI+3o0J3Nn03EcBPtIKeoeyznnjNziDm72HPI2d2+5ZSRz\nxjAd4Nmw+dgGq+UMkusIXgtRK4HcEpwzfImf3zqnKHakSncnFPhGKyNEgn8bK9a7\nAeAvSqMXXsJg8weHUF2NLnAn/42k2wIE8d5BOLaIy13xz6MJn7VUI21pK0zCaGBF\nsfkRFZP0eEVh8ZzU/nWp9E5KDpbsd72biJwvjWH4OrmkfzUWxStQiVwPTxtZD9LW\nc5ZWe+vqZJV9eYRH2hAOMPaYkOQ5Z4DySNVVOFAG0eq9til8+V0k3L7ipIVd2XUB\nmsu6gVP8uZhFYNb8byVJ\n=+0e/\n-----END PGP SIGNATURE-----\n. \n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n+--------------------------+\npatches/packages/httpd-2.4.12-i486-1_slack14.1.txz:  Upgraded. \n  This update fixes the following security issues:\n   * CVE-2014-3583 mod_proxy_fcgi:  Fix a potential crash due to buffer\n     over-read, with response headers\u0027 size above 8K. \n   * CVE-2014-3581 mod_cache:  Avoid a crash when Content-Type has an\n     empty value.  PR 56924. \n   * CVE-2014-8109 mod_lua:  Fix handling of the Require line when a\n     LuaAuthzProvider is used in multiple Require directives with\n     different arguments.  PR57204. \n   * CVE-2013-5704 core:  HTTP trailers could be used to replace HTTP\n     headers late during request processing, potentially undoing or\n     otherwise confusing modules that examined or modified request\n     headers earlier.  Adds \"MergeTrailers\" directive to restore legacy\n     behavior. \n  For more information, see:\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3583\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3581\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8109\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704\n  (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project!  :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.29-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.29-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.29-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.29-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.29-i486-1_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.29-x86_64-1_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.12-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.12-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.12-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.12-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.12-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 13.0 package:\n511973e7033d924fe8f2dfac870cfc9d  httpd-2.2.29-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n5fb45ffc524b4afc2b6e3c322bd43ff2  httpd-2.2.29-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\n47ef44a58d821fe2462817bd308e4c88  httpd-2.2.29-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n4e99389080c31b12a863d315f17e0897  httpd-2.2.29-x86_64-1_slack13.1.txz\n\nSlackware 13.37 package:\n9ecaeefcc21871e101c4e41487879ba7  httpd-2.2.29-i486-1_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n4c4badc191f0c2337d0f05fe4f5f6701  httpd-2.2.29-x86_64-1_slack13.37.txz\n\nSlackware 14.0 package:\n44ee311cec11c0b8b5361871f076060a  httpd-2.4.12-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\nd222d77977fea4f3d2583398070e70fe  httpd-2.4.12-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\nd65e3a24abd582fb54b6da0ba926106e  httpd-2.4.12-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\ne655bdd8f6f7e13da6ae2c70f9c9eea0  httpd-2.4.12-x86_64-1_slack14.1.txz\n\nSlackware -current package:\nbfd8439df17a91bf8b3351a9fdafbfc9  n/httpd-2.4.12-i486-1.txz\n\nSlackware x86_64 -current package:\n3c68dceffdf6de2c67ac2b40fc3846dc  n/httpd-2.4.12-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the package as root:\n# upgradepkg httpd-2.4.12-i486-1_slack14.1.txz\n\nThen, restart Apache httpd:\n\n# /etc/rc.d/rc.httpd stop\n# /etc/rc.d/rc.httpd start\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list:                          |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message:                                                     |\n|                                                                        |\n|   unsubscribe slackware-security                                       |\n|                                                                        |\n| You will get a confirmation message back containing instructions to    |\n| complete the process.  Please do not reply to this email address. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Low: mod_proxy_fcgi and ceph security and bug fix update\nAdvisory ID:       RHSA-2015:1858-01\nProduct:           Red Hat Ceph Storage\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2015:1858\nIssue date:        2015-10-01\nCVE Names:         CVE-2014-3583 \n=====================================================================\n\n1. Summary:\n\nUpdated mod_proxy_fcgi and ceph packages that fix one security issue and\nseveral bugs are now available for CentOS 6. \n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section. \n\n2. Description:\n\nRed Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and support\nservices. \n\nA buffer overflow flaw was found in mod_proxy_fcgi\u0027s handle_headers()\nfunction. A malicious FastCGI server that httpd is configured to connect to\ncould send a carefully crafted response that would cause an httpd child\nprocess handling the request to crash. (CVE-2014-3583)\n\nThis update also fixes the following bugs:\n\n* The RADOS gateway (RGW) can now properly decode the slash characters\n(\"/\") in clients\u0027 upload IDs. (BZ#1183182)\n\n* The RGW\u0027s object attribute updates could race with other object updates\noperations, which led to inconsistent object states, such as incomplete\nobject deletions. RGW now handles attribute updates correctly. (BZ#1206963)\n\n* Recreating a previously existing bucket in RGW did not remove the bucket\ninstance metadata object and created a redundant object in the RGW pool. \nThe redundant objects are no longer generated. (BZ#1212524)\n\n* The Content-Length header is now correctly created when creating a\ncontainer using the Swift API. (BZ#1213988)\n\n* RGW did not properly cache users\u0027 keystone tokens and validated all\nkeystone tokens for every Swift operation. RGW now caches tokens correctly,\nso that the token validation occurs only when necessary. (BZ#1213999)\n\n* Modifying a user\u0027s Access Control List (ACL) permissions for an object in\nRGW inappropriately caused the user to become the owner of the object. \nThis update fixes this bug. (BZ#1214051)\n\n* RGW could fail to update the bucket attributes during a Swift API \"POST\"\noperation. RGW now correctly updates the bucket attributes. (BZ#1214058)\n\n* RGW no longer terminated unexpectedly when using keystone authentication\nto copy an object. (BZ#1214061)\n\n* An attempt to download an object greater than 512 KB using a range header\nfailed when using the Swift API. Objects can now be downloaded as expected. \n(BZ#1214854)\n\n* When using OpenStack\u0027s Cinder RADOS Block Device (RBD) back-end driver\nwith Ceph administration socket enabled, Ceph could leak file descriptors\nand eventually consume the maximum number of allowed opened files. \nThis behavior caused Cinder\u0027s RBD connections to fail. Now, Ceph closes the\nadministration socket appropriately. (BZ#1220496)\n\n* When a part of a multi-part object was resent, the object became broken\ndue a discrepancy between the object size when listing the object and when\nstating the object. Now, multi-part objects no longer become broken in such\na case. (BZ#1222091)\n\n* When the number of placement groups (PGs) in a pool was increased, Ceph\ndid not send watch or notify operations correctly. Consequently, the librbd\nlibrary presented inconsistent RBD snapshot data. Now, Ceph correctly\nre-sends operations. (BZ#1245785)\n\n* When reopening log files, Object Storage Devices (OSDs) could write data\nto the incorrect file descriptor. Consequently, log entries were lost, or\nwere written to a file descriptor, which was opened by the filestore. \nThe latter case could cause data corruption. This bug has been fixed. \n(BZ#1247752)\n\nAll mod_proxy_fcgi and ceph users are advised to upgrade to these updated\npackages, which correct these issues. \n\n3. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nRefer to the following Knowledge Base article for a download link and\nsigning information:\n\nhttps://access.redhat.com/articles/1560193\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1163555 - CVE-2014-3583 httpd: mod_proxy_fcgi handle_headers() buffer over read\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2014-3583\nhttps://access.redhat.com/security/updates/classification/#low\nhttps://access.redhat.com/articles/1560193\nhttps://access.redhat.com/articles/1372203\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2015 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFWDgndXlSAg2UNWIIRApfBAKC3r5aCeSFMsbtE4XsK10F6mj2y9ACdE3jI\noPvjqMGz3njb3os9553TrOY=\n=IgoY\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \nCVE-ID\nCVE-2015-5911 : Zachary Jones of WhiteHat Security Threat Research\nCenter\n\n\nOS X Server 5.0.3 may be obtained from the Mac App Store. Relevant releases/architectures:\n\nRed Hat Common for RHEL Server (v. 6) - x86_64\n\n3. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Common for RHEL Server (v.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "PACKETSTORM",
        "id": "140518"
      },
      {
        "db": "PACKETSTORM",
        "id": "133079"
      },
      {
        "db": "PACKETSTORM",
        "id": "131583"
      },
      {
        "db": "PACKETSTORM",
        "id": "133816"
      },
      {
        "db": "PACKETSTORM",
        "id": "133619"
      },
      {
        "db": "PACKETSTORM",
        "id": "133817"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-3583",
        "trust": 3.5
      },
      {
        "db": "BID",
        "id": "71657",
        "trust": 2.1
      },
      {
        "db": "JVN",
        "id": "JVNVU99970459",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "140518",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "133817",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "133816",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-71523",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "133079",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "131583",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "133619",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "PACKETSTORM",
        "id": "140518"
      },
      {
        "db": "PACKETSTORM",
        "id": "133079"
      },
      {
        "db": "PACKETSTORM",
        "id": "131583"
      },
      {
        "db": "PACKETSTORM",
        "id": "133816"
      },
      {
        "db": "PACKETSTORM",
        "id": "133619"
      },
      {
        "db": "PACKETSTORM",
        "id": "133817"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "id": "VAR-201412-0516",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-07-23T20:10:56.647000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Fixed in Apache httpd 2.4.11-dev",
        "trust": 0.8,
        "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "title": "Revision 1638818",
        "trust": 0.8,
        "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
      },
      {
        "title": "APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006",
        "trust": 0.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/aug/msg00001.html"
      },
      {
        "title": "APPLE-SA-2015-09-16-4 OS X Server 5.0.3",
        "trust": 0.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00004.html"
      },
      {
        "title": "HT205031",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht205031"
      },
      {
        "title": "HT205219",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/ht205219"
      },
      {
        "title": "HT205031",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/ht205031"
      },
      {
        "title": "HT205219",
        "trust": 0.8,
        "url": "http://support.apple.com/ja-jp/ht205219"
      },
      {
        "title": "Oracle Critical Patch Update Advisory - January 2016",
        "trust": 0.8,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
      },
      {
        "title": "Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices",
        "trust": 0.8,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html"
      },
      {
        "title": "Bug 1163555",
        "trust": 0.8,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "title": "January 2016 Critical Patch Update Released",
        "trust": 0.8,
        "url": "https://blogs.oracle.com/security/entry/january_2016_critical_patch_update"
      },
      {
        "title": "mod_proxy_fcgi",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=52863"
      },
      {
        "title": "Red Hat: CVE-2014-3583",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2014-3583"
      },
      {
        "title": "Ubuntu Security Notice: apache2 vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-2523-1"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2015-483",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2015-483"
      },
      {
        "title": "DC-2: Vulnhub Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/dc-2-vulnhub-walkthrough "
      },
      {
        "title": "Shodan Search Script",
        "trust": 0.1,
        "url": "https://github.com/firatesatoglu/shodansearch "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "http://rhn.redhat.com/errata/rhsa-2015-1855.html"
      },
      {
        "trust": 2.1,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
      },
      {
        "trust": 2.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
      },
      {
        "trust": 1.9,
        "url": "https://security.gentoo.org/glsa/201701-36"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2015:1858"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/aug/msg00001.html"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/sep/msg00004.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/71657"
      },
      {
        "trust": 1.8,
        "url": "https://support.apple.com/ht205219"
      },
      {
        "trust": 1.8,
        "url": "https://support.apple.com/kb/ht205031"
      },
      {
        "trust": 1.8,
        "url": "http://www.ubuntu.com/usn/usn-2523-1"
      },
      {
        "trust": 1.7,
        "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
      },
      {
        "trust": 1.5,
        "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3583"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu99970459/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3583"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3583"
      },
      {
        "trust": 0.6,
        "url": "httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "trust": 0.6,
        "url": "http://"
      },
      {
        "trust": 0.6,
        "url": "httpd.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3ccvs."
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2014-3583"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2015/apr/157"
      },
      {
        "trust": 0.3,
        "url": "http://httpd.apache.org/"
      },
      {
        "trust": 0.3,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-1972.html"
      },
      {
        "trust": 0.3,
        "url": "http://prod.lists.apple.com/archives/security-announce/2015/aug/msg00001.html"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8109"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3581"
      },
      {
        "trust": 0.2,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8161"
      },
      {
        "trust": 0.2,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0067"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5704"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "http://svn.apache.org/viewvc?view=revision\u0026amp;revision=1638818"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/2523-1/"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-8073"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5387"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8073"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-0736"
      },
      {
        "trust": 0.1,
        "url": "https://httpoxy.org/"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8743"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-8743"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-5387"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2161"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-8740"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-3583"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8740"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0736"
      },
      {
        "trust": 0.1,
        "url": "https://www.apache.org/security/asf-httpoxy-response.txt"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-2161"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1775"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3613"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-7185"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-us/ht205033"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2776"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-7422"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8767"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5044"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3620"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2777"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-7844"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0106"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1776"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8769"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-7338"
      },
      {
        "trust": 0.1,
        "url": "https://www.safeye.org)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3707"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0191"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5078"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-7040"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-6685"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8150"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8151"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3660"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1912"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-8109"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com"
      },
      {
        "trust": 0.1,
        "url": "http://osuosl.org)"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5704"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3581"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com/gpg-key"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/1560193"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/1372203"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3185"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8500"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0253"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0242"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0241"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0243"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3183"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-1349"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0228"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5911"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3166"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3165"
      },
      {
        "trust": 0.1,
        "url": "http://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3167"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0244"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "PACKETSTORM",
        "id": "140518"
      },
      {
        "db": "PACKETSTORM",
        "id": "133079"
      },
      {
        "db": "PACKETSTORM",
        "id": "131583"
      },
      {
        "db": "PACKETSTORM",
        "id": "133816"
      },
      {
        "db": "PACKETSTORM",
        "id": "133619"
      },
      {
        "db": "PACKETSTORM",
        "id": "133817"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "db": "BID",
        "id": "71657"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "db": "PACKETSTORM",
        "id": "140518"
      },
      {
        "db": "PACKETSTORM",
        "id": "133079"
      },
      {
        "db": "PACKETSTORM",
        "id": "131583"
      },
      {
        "db": "PACKETSTORM",
        "id": "133816"
      },
      {
        "db": "PACKETSTORM",
        "id": "133619"
      },
      {
        "db": "PACKETSTORM",
        "id": "133817"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-12-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "date": "2014-12-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "date": "2014-12-12T00:00:00",
        "db": "BID",
        "id": "71657"
      },
      {
        "date": "2014-12-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "date": "2017-01-16T05:59:00",
        "db": "PACKETSTORM",
        "id": "140518"
      },
      {
        "date": "2015-08-13T22:15:27",
        "db": "PACKETSTORM",
        "id": "133079"
      },
      {
        "date": "2015-04-22T20:14:35",
        "db": "PACKETSTORM",
        "id": "131583"
      },
      {
        "date": "2015-10-02T23:43:29",
        "db": "PACKETSTORM",
        "id": "133816"
      },
      {
        "date": "2015-09-19T15:37:27",
        "db": "PACKETSTORM",
        "id": "133619"
      },
      {
        "date": "2015-10-02T23:43:38",
        "db": "PACKETSTORM",
        "id": "133817"
      },
      {
        "date": "2014-12-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "date": "2014-12-15T18:59:02.190000",
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-10-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-71523"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-3583"
      },
      {
        "date": "2017-01-23T01:11:00",
        "db": "BID",
        "id": "71657"
      },
      {
        "date": "2016-01-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      },
      {
        "date": "2021-06-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      },
      {
        "date": "2023-11-07T02:20:14.410000",
        "db": "NVD",
        "id": "CVE-2014-3583"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apache HTTP Server of  mod_proxy_fcgi Module  mod_proxy_fcgi.c Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-007220"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201412-332"
      }
    ],
    "trust": 0.6
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.9.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "06A4AE53-A477-4386-887C-4B7408575C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8A2286E-9D1C-4B56-8B40-150201B818AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AF9BC68-7F0D-4DF9-9CD8-6CE9844555C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D35FAC77-A0DD-4AF9-AA9E-A4B170842D2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "831B1114-7CA7-43E3-9A15-592218060A1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8B0A12E-E122-4189-A05E-4FEA43C19876",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:os_x_server:5.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D3E28FF-F00B-45A8-8120-95847AF83CB5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3ECBCB1-0675-41F5-857B-438F36925F63",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "5D37DF0F-F863-45AC-853A-3E04F9FEC7CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n handle_headers en mod_proxy_fcgi.c en el m\u00f3dulo mod_proxy_fcgi en Apache HTTP Server 2.4.10 permite a servidores remotoos FastCGI causar una denegaci\u00f3n de servicio (sobre lectura de buffer y ca\u00edda del demonio) a trav\u00e9s de cabeceras de respuesta largas."
    }
  ],
  "id": "CVE-2014-3583",
  "lastModified": "2024-11-21T02:08:26.830",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-12-15T18:59:02.190",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1855.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/71657"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-2523-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2015:1858"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://security.gentoo.org/glsa/201701-36"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://support.apple.com/HT205219"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://support.apple.com/kb/HT205031"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1855.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1638818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/71657"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2523-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2015:1858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1163555"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201701-36"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/HT205219"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/kb/HT205031"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}