{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201407-0515",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "http server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apache",
        "version": "2.4.9"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apache",
        "version": "2.4.7"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apache",
        "version": "2.4.6"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apache",
        "version": "2.4.8"
      },
      {
        "model": "mac os x",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.10.2"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.10 to  10.10.2"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "12.1.3.0"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apache",
        "version": "2.4.10"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.9.5"
      },
      {
        "model": "http server",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "apache",
        "version": "2.4.x"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "of  enterprise manager ops center 11.1.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.8.5"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "11.1.1.7.0"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "10.1.3.5.0"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "of  enterprise manager ops center 12.1.4"
      },
      {
        "model": "http server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "12.1.2.0"
      },
      {
        "model": "httpd server 2.x",
        "scope": null,
        "trust": 0.7,
        "vendor": "apache",
        "version": null
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.9.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.8.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.9"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.8"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.7"
      },
      {
        "model": "apache",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.4.6"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.10.3"
      },
      {
        "model": "2.4.10-dev",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apache",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "BID",
        "id": "68740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "10.10.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "AKAT-1   22733db72ab3ed94b5f8a1ffcde850251fe6f466  Marek Kroemeke",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2014-0117",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2014-0117",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "ZDI",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-0117",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "HIGH",
            "trust": 0.7,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-67610",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-0117",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "ZDI",
            "id": "CVE-2014-0117",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201407-491",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-67610",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header. Authentication is not required to exploit this vulnerability.The specific flaw exists within the mod_proxy module.  The issue lies in the processing of HTTP headers when an invalid request is made. \nSuccessful exploits may allow an attacker to cause an affected application to crash, resulting in a denial-of-service condition. mod_proxy is one of the proxy modules. \n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n+--------------------------+\npatches/packages/httpd-2.4.10-i486-1_slack14.1.txz:  Upgraded.  See directives\n     DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,\n     and DeflateInflateRatioBurst.  [Joe Orton, Eric Covener]\n  *) SECURITY: CVE-2014-0231 (cve.mitre.org)\n     mod_cgid: Fix a denial of service against CGI scripts that do\n     not consume stdin that could lead to lingering HTTPD child processes\n     filling up the scoreboard and eventually hanging the server.  By\n     default, the client I/O timeout (Timeout directive) now applies to\n     communication with scripts.  The CGIDScriptTimeout directive can be\n     used to set a different timeout for communication with scripts. \n     [Rainer Jung, Eric Covener, Yann Ylavic]\n  For more information, see:\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0117\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0118\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226\n    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231\n  (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project!  :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.27-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.27-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.27-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.27-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.27-i486-1_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.27-x86_64-1_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.10-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.10-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.10-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.10-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.10-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.10-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 13.0 package:\nc79e696c379625efd18e6414f30dba80  httpd-2.2.27-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n28be181b3a0aae494371279230f190e9  httpd-2.2.27-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\nfc409fff4d79cb1969a40756f8a9f576  httpd-2.2.27-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n07ab0f3337fc15656cd2e841c9b0eba4  httpd-2.2.27-x86_64-1_slack13.1.txz\n\nSlackware 13.37 package:\nb5cefd8903745aceaa68b482cb63e4e2  httpd-2.2.27-i486-1_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n610a33703e7f84fd14f09bc9529c1cd5  httpd-2.2.27-x86_64-1_slack13.37.txz\n\nSlackware 14.0 package:\nd6dedc1064a6a4d039b188fed02de89b  httpd-2.4.10-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n7d150bf3bd558bf70ea2c21a08a1b5b7  httpd-2.4.10-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n7e9b03930b0452a95595a61cf1b093d8  httpd-2.4.10-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\nefc9893a3428d87a8d78787fbde793e0  httpd-2.4.10-x86_64-1_slack14.1.txz\n\nSlackware -current package:\n1ac5a4cc6275c8f7cfa6e3a77a27f2db  n/httpd-2.4.10-i486-1.txz\n\nSlackware x86_64 -current package:\n7fa5fda601a324238f5a2768204a7476  n/httpd-2.4.10-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the package as root:\n# upgradepkg httpd-2.4.10-i486-1_slack14.1.txz\n\nThen, restart Apache httpd:\n\n# /etc/rc.d/rc.httpd stop\n# /etc/rc.d/rc.httpd start\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list:                          |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message:                                                     |\n|                                                                        |\n|   unsubscribe slackware-security                                       |\n|                                                                        |\n| You will get a confirmation message back containing instructions to    |\n| complete the process.  Please do not reply to this email address. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004\n\nOS X Yosemite 10.10.3 and Security Update 2015-004 are now available\nand address the following:\n\nAdmin Framework\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A process may gain admin privileges without properly\nauthenticating\nDescription:  An issue existed when checking XPC entitlements. This\nissue was addressed with improved entitlement checking. \nCVE-ID\nCVE-2015-1130 : Emil Kvarnhammar at TrueSec\n\napache\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Multiple vulnerabilities in Apache\nDescription:  Multiple vulnerabilities existed in Apache versions\nprior to 2.4.10 and 2.2.29, including one that may allow a remote\nattacker to execute arbitrary code. These issues were addressed by\nupdating Apache to versions 2.4.10 and 2.2.29\nCVE-ID\nCVE-2013-0118\nCVE-2013-5704\nCVE-2013-6438\nCVE-2014-0098\nCVE-2014-0117\nCVE-2014-0118\nCVE-2014-0226\nCVE-2014-0231\nCVE-2014-3523\n\nATS\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  Multiple input validation issues existed in fontd. \nThese issues were addressed through improved input validation. \nCVE-ID\nCVE-2015-1131 : Ian Beer of Google Project Zero\nCVE-2015-1132 : Ian Beer of Google Project Zero\nCVE-2015-1133 : Ian Beer of Google Project Zero\nCVE-2015-1134 : Ian Beer of Google Project Zero\nCVE-2015-1135 : Ian Beer of Google Project Zero\n\nCertificate Trust Policy\nImpact:  Update to the certificate trust policy\nDescription:  The certificate trust policy was updated. The complete\nlist of certificates may be viewed at https://support.apple.com/en-\nus/HT202858. \n\nCFNetwork HTTPProtocol\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  Cookies belonging to one origin may be sent to another\norigin\nDescription:  A cross-domain cookie issue existed in redirect\nhandling. Cookies set in a redirect response could be passed on to a\nredirect target belonging to another origin. The issue was address\nthrough improved handling of redirects. \nCVE-ID\nCVE-2015-1089 : Niklas Keller\n\nCFNetwork Session\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  Authentication credentials may be sent to a server on\nanother origin\nDescription:  A cross-domain HTTP request headers issue existed in\nredirect handling. The issue was addressed through\nimproved handling of redirects. \nCVE-ID\nCVE-2015-1091 : Diego Torres (http://dtorres.me)\n\nCFURL\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  Visiting a maliciously crafted website may lead to arbitrary\ncode execution\nDescription:  An input validation issue existed within URL\nprocessing. This issue was addressed through improved URL validation. \nCVE-ID\nCVE-2015-1088 : Luigi Galli\n\nCoreAnimation\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Visiting a maliciously crafted website may lead to arbitrary\ncode execution\nDescription:  A use-after-free issue existed in CoreAnimation. This\nissue was addressed through improved mutex management. \nCVE-ID\nCVE-2015-1136 : Apple\n\nFontParser\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription:  Multiple memory corruption issues existed in the\nprocessing of font files. These issues were addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2015-1093 : Marc Schoenefeld\n\nGraphics Driver\nAvailable for:  OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A NULL pointer dereference existed in NVIDIA graphics\ndriver\u0027s handling of certain IOService userclient types. This issue\nwas addressed through additional context validation. \nCVE-ID\nCVE-2015-1137 :\nFrank Graziano and John Villamil of the Yahoo Pentest Team\n\nHypervisor\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A local application may be able to cause a denial of service\nDescription:  An input validation issue existed in the hypervisor\nframework. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2015-1138 : Izik Eidus and Alex Fishman\n\nImageIO\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Processing a maliciously crafted .sgi file may lead to\narbitrary code execution\nDescription:  A memory corruption issue existed in the handling of\n.sgi files. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2015-1139 : Apple\n\nIOHIDFamily\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A malicious HID device may be able to cause arbitrary code\nexecution\nDescription:  A memory corruption issue existed in an IOHIDFamily\nAPI. This issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-1095 : Andrew Church\n\nIOHIDFamily\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A buffer overflow issue existed in IOHIDFamily. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-1140 : lokihardt@ASRT working with HP\u0027s Zero Day Initiative,\nLuca Todesco\n\nIOHIDFamily\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to determine kernel memory layout\nDescription:  An issue existed in IOHIDFamily that led to the\ndisclosure of kernel memory content. This issue was addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2015-1096 : Ilja van Sprundel of IOActive\n\nIOHIDFamily\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A heap buffer overflow existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2014-4404 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5\nImpact:  A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription:  A null pointer dereference existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved validation of IOHIDFamily key-mapping properties. \nCVE-ID\nCVE-2014-4405 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5\nImpact:  A user may be able to execute arbitrary code with system\nprivileges\nDescription:  An out-of-bounds write issue exited in the IOHIDFamily\ndriver. The issue was addressed through improved input validation. \nCVE-ID\nCVE-2014-4380 : cunzhang from Adlab of Venustech\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to cause unexpected system shutdown\nDescription:  An issue existed in the handling of virtual memory\noperations within the kernel. The issue is fixed through improved\nhandling of the mach_vm_read operation. \nCVE-ID\nCVE-2015-1141 : Ole Andre Vadla Ravnas of www.frida.re\n\nKernel\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to cause a system denial of service\nDescription:  A race condition existed in the kernel\u0027s setreuid\nsystem call. This issue was addressed through improved state\nmanagement. \nCVE-ID\nCVE-2015-1099 : Mark Mentovai of Google Inc. \n\nKernel\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local application may escalate privileges using a\ncompromised service intended to run with reduced privileges\nDescription:  setreuid and setregid system calls failed to drop\nprivileges permanently. This issue was addressed by correctly\ndropping privileges. \nCVE-ID\nCVE-2015-1117 : Mark Mentovai of Google Inc. \n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  An attacker with a privileged network position may be able\nto redirect user traffic to arbitrary hosts\nDescription:  ICMP redirects were enabled by default on OS X. This\nissue was addressed by disabling ICMP redirects. \nCVE-ID\nCVE-2015-1103 : Zimperium Mobile Security Labs\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  An attacker with a privileged network position may be able\nto cause a denial of service\nDescription:  A state inconsistency existed in the processing of TCP\nheaders. This issue was addressed through improved state handling. \nCVE-ID\nCVE-2015-1102 : Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab\n\nKernel\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to cause unexpected system\ntermination or read kernel memory\nDescription:  A out of bounds memory access issue existed in the\nkernel. This issue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-1100 : Maxime Villard of m00nbsd\n\nKernel\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A remote attacker may be able to bypass network filters\nDescription:  The system would treat some IPv6 packets from remote\nnetwork interfaces as local packets. The issue was addressed by\nrejecting these packets. \nCVE-ID\nCVE-2015-1104 : Stephen Roettger of the Google Security Team\n\nKernel\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue existed in the kernel. This\nissue was addressed through improved memory handling. \nCVE-ID\nCVE-2015-1101 : lokihardt@ASRT working with HP\u0027s Zero Day Initiative\n\nKernel\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A remote attacker may be able to cause a denial of service\nDescription:  A state inconsistency issue existed in the handling of\nTCP out of band data. This issue was addressed through improved state\nmanagement. \nCVE-ID\nCVE-2015-1105 : Kenton Varda of Sandstorm.io\n\nLaunchServices\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to cause the Finder to crash\nDescription:  An input validation issue existed in LaunchServices\u0027s\nhandling of application localization data. This issue was addressed\nthrough improved validation of localization data. \nCVE-ID\nCVE-2015-1142\n\nLaunchServices\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A type confusion issue existed in LaunchServices\u0027s\nhandling of localized strings. This issue was addressed through\nadditional bounds checking. \nCVE-ID\nCVE-2015-1143 : Apple\n\nlibnetcore\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  Processing a maliciously crafted configuration profile may\nlead to unexpected application termination\nDescription:  A memory corruption issue existed in the handling of\nconfiguration profiles. This issue was addressed through improved\nbounds checking. \nCVE-ID\nCVE-2015-1118 : Zhaofeng Chen, Hui Xue, Yulong Zhang, and Tao Wei of\nFireEye, Inc. \n\nntp\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A remote attacker may brute force ntpd authentication keys\nDescription:  The config_auth function in ntpd generated a weak key\nwhen an authentication key was not configured. This issue was\naddressed by improved key generation. \nCVE-ID\nCVE-2014-9298\n\nOpenLDAP\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A remote unauthenticated client may be able to cause a\ndenial of service\nDescription:  Multiple input validation issues existed in OpenLDAP. \nThese issues were addressed by improved input validation. \nCVE-ID\nCVE-2015-1545 : Ryan Tandy\nCVE-2015-1546 : Ryan Tandy\n\nOpenSSL\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Multiple vulnerabilities in OpenSSL\nDescription:  Multiple vulnerabilities existed in OpenSSL 0.9.8zc,\nincluding one that may allow an attacker to intercept connections to\na server that supports export-grade ciphers. These issues were\naddressed by updating OpenSSL to version 0.9.8zd. \nCVE-ID\nCVE-2014-3569\nCVE-2014-3570\nCVE-2014-3571\nCVE-2014-3572\nCVE-2014-8275\nCVE-2015-0204\n\nOpen Directory Client\nAvailable for:  OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A password might be sent unencrypted over the network when\nusing Open Directory from OS X Server\nDescription:  If an Open Directory client was bound to an OS X Server\nbut did not install the certificates of the OS X Server, and then a\nuser on that client changed their password, the password change\nrequest was sent over the network without encryption. This issue was\naddressed by having the client require encryption for this case. \nCVE-ID\nCVE-2015-1147 : Apple\n\nPHP\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Multiple vulnerabilities in PHP\nDescription:  Multiple vulnerabilities existed in PHP versions prior\nto 5.3.29, 5.4.38, and 5.5.20, including one which may have led to\narbitrary code execution. This update addresses the issues by\nupdating PHP to versions 5.3.29, 5.4.38, and 5.5.20. \nCVE-ID\nCVE-2013-6712\nCVE-2014-0207\nCVE-2014-0237\nCVE-2014-0238\nCVE-2014-2497\nCVE-2014-3478\nCVE-2014-3479\nCVE-2014-3480\nCVE-2014-3487\nCVE-2014-3538\nCVE-2014-3587\nCVE-2014-3597\nCVE-2014-3668\nCVE-2014-3669\nCVE-2014-3670\nCVE-2014-3710\nCVE-2014-3981\nCVE-2014-4049\nCVE-2014-4670\nCVE-2014-4698\nCVE-2014-5120\n\nQuickLook\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Opening a maliciously crafted iWork file may lead to\narbitrary code execution\nDescription:  A memory corruption issue existed in the handling of\niWork files. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2015-1098 : Christopher Hickstein\n\nSceneKit\nAvailable for:  OS X Mountain Lion v10.8.5\nImpact:  Viewing a maliciously crafted Collada file may lead to\narbitrary code execution\nDescription:  A heap buffer overflow existed in SceneKit\u0027s handling\nof Collada files. Viewing a maliciously crafted Collada file may have\nled to arbitrary code execution. This issue was addressed through\nimproved validation of accessor elements. \nCVE-ID\nCVE-2014-8830 : Jose Duart of Google Security Team\n\nScreen Sharing\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  A user\u0027s password may be logged to a local file\nDescription:  In some circumstances, Screen Sharing may log a user\u0027s\npassword that is not readable by other users on the system. This\nissue was addressed by removing logging of credential. \nCVE-ID\nCVE-2015-1148 : Apple\n\nSecurity - Code Signing\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  Tampered applications may not be prevented from launching\nDescription:  Applications containing specially crafted bundles may\nhave been able to launch without a completely valid signature. This\nissue was addressed by adding additional checks. \nCVE-ID\nCVE-2015-1145\nCVE-2015-1146\n\nUniformTypeIdentifiers\nAvailable for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\nOS X Yosemite v10.10 to v10.10.2\nImpact:  A local user may be able to execute arbitrary code with\nsystem privileges\nDescription:  A buffer overflow existed in the way Uniform Type\nIdentifiers were handled. This issue was addressed with improved\nbounds checking. \nCVE-ID\nCVE-2015-1144 : Apple\n\nWebKit\nAvailable for:  OS X Yosemite v10.10 to v10.10.2\nImpact:  Visiting a maliciously crafted website may lead to arbitrary\ncode execution\nDescription:  A memory corruption issue existed in WebKit. This\nissues was addressed through improved memory handling. \nCVE-ID\nCVE-2015-1069 : lokihardt@ASRT working with HP\u0027s Zero Day Initiative\n\nSecurity Update 2015-004 (available for OS X Mountain Lion v10.8.5\nand OS X Mavericks v10.9.5) also addresses an issue caused by the fix\nfor CVE-2015-1067 in Security Update 2015-002. This issue prevented\nRemote Apple Events clients on any version from connecting to the\nRemote Apple Events server. In default configurations, Remote Apple\nEvents is not enabled. \n\nOS X Yosemite 10.10.3 includes the security content of Safari 8.0.5. \nhttps://support.apple.com/en-us/HT204658\n\nOS X Yosemite 10.10.3 and Security Update 2015-004 may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJVJKj2AAoJEBcWfLTuOo7tDh4QAK0LxfwMRKcdOXOKpXsRz6lg\nlhZ+CLVcSepq8qBkFQ74f3B5CuhxD0IGQPaAuSXl51tWYdfN+92tkbmyZ9k8901l\n+I0vw6upeE+oqRnGtSRzq68UhcARbdV8V1+C0Xl3IIuuHc+xlEgvklDhF9Pc8XM6\nDudGiVNqt6MOqd5Oc4s4FFF0nnpnyG9+UJem3mi4Ee88PwI4x1Hev7utPPmaPDzj\ncjkVeislko3QArNJxtBpkYudErA4eR5OX8Tdf12jAmPTtjrXUb3VigEf78Nna0RW\nkHTOGdB5EZ+YFZ8KlyIQlENBjTtI8CGdCF4/S/2xDN83NTRsimd5Y7LSjdd0uANo\npqxAc3Gzn5xngWF1Qbb6V+XZBfz5NoeTq5BXBB5OHz4PSGaQuMsBA2RYFMzNLqWv\nD/T5U1JtzRLALt0lYAz63B0OhW7KXeLI9oer1Vo4wWF9O9cUFyuSI4JU5uYLQpJX\nkEpSFt4YPFFxMnlzCLzLkmVGax4w9M/tRHYeSKAnRlnsoPBtIGFItlNZE2RduD/R\n5n2APoJa3banQ8miycGORYP3WsktDRZzBy+2QPWuz8sE3AvAkO9xWp8PrQBkqf/b\n6CIG5UkCYITG2uzBXqnGbfDiEDvBLNN1Yq0ZZI23iYRxrdW0I0pv1CHio354q12G\nvVE37tYUU4PnLfwlcazq\n=MOsT\n-----END PGP SIGNATURE-----\n. \n \n mod_lua.c in the mod_lua module in the Apache HTTP Server through\n 2.4.10 does not support an httpd configuration in which the same\n Lua authorization provider is used with different arguments within\n different contexts, which allows remote attackers to bypass intended\n access restrictions in opportunistic circumstances by leveraging\n multiple Require directives, as demonstrated by a configuration that\n specifies authorization for one group to access a certain directory,\n and authorization for a second group to access a second directory\n (CVE-2014-8109). A malicious client could\n use Trailer headers to set additional HTTP headers after header\n processing was performed by other modules. This could, for example,\n lead to a bypass of header restrictions defined with mod_headers\n (CVE-2013-5704). A newly introduced\n configuration directive MergeTrailers can be used to re-enable the\n old method of processing Trailer headers, which also re-introduces\n the aforementioned flaw. \n \n This update also fixes the following bug:\n \n Prior to this update, the mod_proxy_wstunnel module failed to set\n up an SSL connection when configured to use a back end server using\n the wss: URL scheme, causing proxied connections to fail. In these\n updated packages, SSL is used when proxying to wss: back end servers\n (rhbz#1141950).  The verification\n of md5 checksums and GPG signatures is performed automatically for you. 7) - noarch, x86_64\n\n3. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: httpd security update\nAdvisory ID:       RHSA-2014:0921-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0921.html\nIssue date:        2014-07-23\nCVE Names:         CVE-2013-4352 CVE-2014-0117 CVE-2014-0118 \n                   CVE-2014-0226 CVE-2014-0231 \n=====================================================================\n\n1. Summary:\n\nUpdated httpd packages that fix multiple security issues are now available\nfor Red Hat Enterprise Linux 7. \n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux Server (v. 7) - noarch, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. \n\nA race condition flaw, leading to heap-based buffer overflows, was found in\nthe mod_status httpd module. A remote attacker able to access a status page\nserved by mod_status on a server using a threaded Multi-Processing Module\n(MPM) could send a specially crafted request that would cause the httpd\nchild process to crash or, possibly, allow the attacker to execute\narbitrary code with the privileges of the \"apache\" user. (CVE-2014-0226)\n\nA NULL pointer dereference flaw was found in the mod_cache httpd module. \n(CVE-2013-4352)\n\nA denial of service flaw was found in the mod_proxy httpd module. (CVE-2014-0117)\n\nA denial of service flaw was found in the way httpd\u0027s mod_deflate module\nhandled request body decompression (configured via the \"DEFLATE\" input\nfilter). A remote attacker able to send a request whose body would be\ndecompressed could use this flaw to consume an excessive amount of system\nmemory and CPU on the target system. (CVE-2014-0118)\n\nA denial of service flaw was found in the way httpd\u0027s mod_cgid module\nexecuted CGI scripts that did not read data from the standard input. \nA remote attacker could submit a specially crafted request that would cause\nthe httpd child process to hang indefinitely. (CVE-2014-0231)\n\nAll httpd users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. After installing the\nupdated packages, the httpd daemon will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1120596 - CVE-2014-0231 httpd: mod_cgid denial of service\n1120599 - CVE-2014-0117 httpd: mod_proxy denial of service\n1120601 - CVE-2014-0118 httpd: mod_deflate denial of service\n1120603 - CVE-2014-0226 httpd: mod_status heap-based buffer overflow\n1120604 - CVE-2013-4352 httpd: mod_cache NULL pointer dereference crash\n\n6. Package List:\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nSource:\nhttpd-2.4.6-18.el7_0.src.rpm\n\nnoarch:\nhttpd-manual-2.4.6-18.el7_0.noarch.rpm\n\nx86_64:\nhttpd-2.4.6-18.el7_0.x86_64.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nhttpd-devel-2.4.6-18.el7_0.x86_64.rpm\nhttpd-tools-2.4.6-18.el7_0.x86_64.rpm\nmod_ldap-2.4.6-18.el7_0.x86_64.rpm\nmod_proxy_html-2.4.6-18.el7_0.x86_64.rpm\nmod_session-2.4.6-18.el7_0.x86_64.rpm\nmod_ssl-2.4.6-18.el7_0.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nSource:\nhttpd-2.4.6-18.el7_0.src.rpm\n\nnoarch:\nhttpd-manual-2.4.6-18.el7_0.noarch.rpm\n\nx86_64:\nhttpd-2.4.6-18.el7_0.x86_64.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nhttpd-devel-2.4.6-18.el7_0.x86_64.rpm\nhttpd-tools-2.4.6-18.el7_0.x86_64.rpm\nmod_ldap-2.4.6-18.el7_0.x86_64.rpm\nmod_proxy_html-2.4.6-18.el7_0.x86_64.rpm\nmod_session-2.4.6-18.el7_0.x86_64.rpm\nmod_ssl-2.4.6-18.el7_0.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nhttpd-2.4.6-18.el7_0.src.rpm\n\nnoarch:\nhttpd-manual-2.4.6-18.el7_0.noarch.rpm\n\nppc64:\nhttpd-2.4.6-18.el7_0.ppc64.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.ppc64.rpm\nhttpd-devel-2.4.6-18.el7_0.ppc64.rpm\nhttpd-tools-2.4.6-18.el7_0.ppc64.rpm\nmod_ssl-2.4.6-18.el7_0.ppc64.rpm\n\ns390x:\nhttpd-2.4.6-18.el7_0.s390x.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.s390x.rpm\nhttpd-devel-2.4.6-18.el7_0.s390x.rpm\nhttpd-tools-2.4.6-18.el7_0.s390x.rpm\nmod_ssl-2.4.6-18.el7_0.s390x.rpm\n\nx86_64:\nhttpd-2.4.6-18.el7_0.x86_64.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nhttpd-devel-2.4.6-18.el7_0.x86_64.rpm\nhttpd-tools-2.4.6-18.el7_0.x86_64.rpm\nmod_ssl-2.4.6-18.el7_0.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nhttpd-debuginfo-2.4.6-18.el7_0.ppc64.rpm\nmod_ldap-2.4.6-18.el7_0.ppc64.rpm\nmod_proxy_html-2.4.6-18.el7_0.ppc64.rpm\nmod_session-2.4.6-18.el7_0.ppc64.rpm\n\ns390x:\nhttpd-debuginfo-2.4.6-18.el7_0.s390x.rpm\nmod_ldap-2.4.6-18.el7_0.s390x.rpm\nmod_proxy_html-2.4.6-18.el7_0.s390x.rpm\nmod_session-2.4.6-18.el7_0.s390x.rpm\n\nx86_64:\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nmod_ldap-2.4.6-18.el7_0.x86_64.rpm\nmod_proxy_html-2.4.6-18.el7_0.x86_64.rpm\nmod_session-2.4.6-18.el7_0.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nhttpd-2.4.6-18.el7_0.src.rpm\n\nnoarch:\nhttpd-manual-2.4.6-18.el7_0.noarch.rpm\n\nx86_64:\nhttpd-2.4.6-18.el7_0.x86_64.rpm\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nhttpd-devel-2.4.6-18.el7_0.x86_64.rpm\nhttpd-tools-2.4.6-18.el7_0.x86_64.rpm\nmod_ssl-2.4.6-18.el7_0.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nhttpd-debuginfo-2.4.6-18.el7_0.x86_64.rpm\nmod_ldap-2.4.6-18.el7_0.x86_64.rpm\nmod_proxy_html-2.4.6-18.el7_0.x86_64.rpm\nmod_session-2.4.6-18.el7_0.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2013-4352.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0117.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0118.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0226.html\nhttps://www.redhat.com/security/data/cve/CVE-2014-0231.html\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e.  More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2014 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFTz4k8XlSAg2UNWIIRAhYKAJ9g2VrkFgyFz55UEfv0x8fGXSyjwACghfJ7\nzOzeWbMF1aXEVExM5K4QNMA=\n=qBwW\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. ============================================================================\nUbuntu Security Notice USN-2299-1\nJuly 23, 2014\n\napache2 vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n- Ubuntu 10.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Apache HTTP Server. This issue only\naffected Ubuntu 14.04 LTS. \n(CVE-2014-0118)\n\nMarek Kroemeke and others discovered that the mod_status module incorrectly\nhandled certain requests. (CVE-2014-0226)\n\nRainer Jung discovered that the mod_cgid module incorrectly handled certain\nscripts. (CVE-2014-0231)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 LTS:\n  apache2-bin                     2.4.7-1ubuntu4.1\n\nUbuntu 12.04 LTS:\n  apache2.2-bin                   2.2.22-1ubuntu1.7\n\nUbuntu 10.04 LTS:\n  apache2.2-bin                   2.2.14-5ubuntu8.14\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "BID",
        "id": "68740"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "PACKETSTORM",
        "id": "127598"
      },
      {
        "db": "PACKETSTORM",
        "id": "131359"
      },
      {
        "db": "PACKETSTORM",
        "id": "131098"
      },
      {
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "db": "PACKETSTORM",
        "id": "127585"
      }
    ],
    "trust": 3.15
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0117",
        "trust": 4.1
      },
      {
        "db": "ZDI",
        "id": "ZDI-14-239",
        "trust": 2.7
      },
      {
        "db": "JVN",
        "id": "JVNVU91828320",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-2241",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "68740",
        "trust": 0.4
      },
      {
        "db": "PACKETSTORM",
        "id": "127585",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "127598",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "127563",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "131359",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "131098",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "127586",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "127588",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "BID",
        "id": "68740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "PACKETSTORM",
        "id": "127598"
      },
      {
        "db": "PACKETSTORM",
        "id": "131359"
      },
      {
        "db": "PACKETSTORM",
        "id": "131098"
      },
      {
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "db": "PACKETSTORM",
        "id": "127585"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "id": "VAR-201407-0515",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T10:47:41.910000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Fixed in Apache httpd 2.4.10",
        "trust": 0.8,
        "url": "http://httpd.apache.org/security/vulnerabilities_24.html#2.4.10"
      },
      {
        "title": "Diff of /httpd/httpd/trunk/modules/proxy/proxy_util.c",
        "trust": 0.8,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "title": "Diff of /httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
        "trust": 0.8,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "title": "Log of /httpd/httpd/trunk/modules/proxy/mod_proxy_http.c",
        "trust": 0.8,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c"
      },
      {
        "title": "Log of /httpd/httpd/trunk/modules/proxy/proxy_util.c",
        "trust": 0.8,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c"
      },
      {
        "title": "APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004",
        "trust": 0.8,
        "url": "http://lists.apple.com/archives/security-announce/2015/apr/msg00001.html"
      },
      {
        "title": "HT204659",
        "trust": 0.8,
        "url": "http://support.apple.com/en-us/ht204659"
      },
      {
        "title": "HT204659",
        "trust": 0.8,
        "url": "http://support.apple.com/ja-jp/ht204659"
      },
      {
        "title": "Oracle Critical Patch Update Advisory - January 2015",
        "trust": 0.8,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
      },
      {
        "title": "Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices",
        "trust": 0.8,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html"
      },
      {
        "title": "Bug 1120599",
        "trust": 0.8,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120599"
      },
      {
        "title": "January 2015 Critical Patch Update Released",
        "trust": 0.8,
        "url": "https://blogs.oracle.com/security/entry/january_2015_critical_patch_update"
      },
      {
        "title": "Multiple Denial Of Service(DoS) vulnerabilities in Apache HTTP Server",
        "trust": 0.8,
        "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_denial_of_service_dos5"
      },
      {
        "title": "Apache has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "title": "httpd-2.4.10",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=50900"
      },
      {
        "title": "httpd-2.4.10",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=50901"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-20",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://advisories.mageia.org/mgasa-2014-0305.html"
      },
      {
        "trust": 2.1,
        "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "trust": 2.0,
        "url": "http://seclists.org/fulldisclosure/2014/jul/117"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2015/apr/msg00001.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120599"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/ht204659"
      },
      {
        "trust": 1.7,
        "url": "http://zerodayinitiative.com/advisories/zdi-14-239/"
      },
      {
        "trust": 1.1,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c"
      },
      {
        "trust": 1.1,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c"
      },
      {
        "trust": 1.0,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0117"
      },
      {
        "trust": 1.0,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "trust": 1.0,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu91828320/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0117"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0118"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0117"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0231"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0226"
      },
      {
        "trust": 0.6,
        "url": "httpd.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "httpd.apache.org/security/vulnerabilities_24.html"
      },
      {
        "trust": 0.6,
        "url": "http://"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "http.c?r1=1599486\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "trust": 0.6,
        "url": "httpd/trunk/modules/proxy/mod_proxy_"
      },
      {
        "trust": 0.6,
        "url": "http://svn.apache.org/viewvc/"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "httpd/trunk/modules/proxy/proxy_util.c"
      },
      {
        "trust": 0.6,
        "url": "httpd/trunk/modules/proxy/proxy_util.c?r1=1609680\u0026r2=1610674\u0026diff_format=h"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs."
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3ccvs."
      },
      {
        "trust": 0.3,
        "url": "http://httpd.apache.org/"
      },
      {
        "trust": 0.3,
        "url": "http://www.zerodayinitiative.com/advisories/zdi-14-239/"
      },
      {
        "trust": 0.2,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0231"
      },
      {
        "trust": 0.2,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0118"
      },
      {
        "trust": 0.2,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0226"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-6438"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0098"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0117.html"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/security/data/cve/cve-2013-4352.html"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/key/#package"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4352"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0118.html"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0226.html"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/security/data/cve/cve-2014-0231.html"
      },
      {
        "trust": 0.1,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1599486\u0026amp;r2=1610674\u0026amp;diff_format=h"
      },
      {
        "trust": 0.1,
        "url": "http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?r1=1609680\u0026amp;r2=1610674\u0026amp;diff_format=h"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3ccvs.httpd.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com"
      },
      {
        "trust": 0.1,
        "url": "http://osuosl.org)"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com/gpg-key"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-0118"
      },
      {
        "trust": 0.1,
        "url": "https://www.frida.re"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-us/ht204658"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3487"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3571"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3597"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3670"
      },
      {
        "trust": 0.1,
        "url": "http://support.apple.com/kb/ht1222"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0238"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3572"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-2497"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3523"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3587"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0237"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3669"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/en-"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3538"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3480"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3668"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0207"
      },
      {
        "trust": 0.1,
        "url": "http://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5704"
      },
      {
        "trust": 0.1,
        "url": "http://dtorres.me)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3479"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3570"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3478"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3569"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-6712"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-8109"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-5704"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2014-0527.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-3581"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0228"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5704"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2014-0135.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-8109"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2015-0011.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6438"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0098"
      },
      {
        "trust": 0.1,
        "url": "http://advisories.mageia.org/mgasa-2015-0099.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3581"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0228"
      },
      {
        "trust": 0.1,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0922.html"
      },
      {
        "trust": 0.1,
        "url": "https://rhn.redhat.com/errata/rhsa-2014-0921.html"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache2/2.2.14-5ubuntu8.14"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.7"
      },
      {
        "trust": 0.1,
        "url": "http://www.ubuntu.com/usn/usn-2299-1"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "BID",
        "id": "68740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "PACKETSTORM",
        "id": "127598"
      },
      {
        "db": "PACKETSTORM",
        "id": "131359"
      },
      {
        "db": "PACKETSTORM",
        "id": "131098"
      },
      {
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "db": "PACKETSTORM",
        "id": "127585"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "db": "BID",
        "id": "68740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "db": "PACKETSTORM",
        "id": "127598"
      },
      {
        "db": "PACKETSTORM",
        "id": "131359"
      },
      {
        "db": "PACKETSTORM",
        "id": "131098"
      },
      {
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "db": "PACKETSTORM",
        "id": "127585"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-18T00:00:00",
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "date": "2014-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "date": "2014-07-15T00:00:00",
        "db": "BID",
        "id": "68740"
      },
      {
        "date": "2014-07-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "date": "2014-07-24T23:46:22",
        "db": "PACKETSTORM",
        "id": "127598"
      },
      {
        "date": "2015-04-09T16:30:50",
        "db": "PACKETSTORM",
        "id": "131359"
      },
      {
        "date": "2015-03-30T21:25:14",
        "db": "PACKETSTORM",
        "id": "131098"
      },
      {
        "date": "2014-07-23T20:48:47",
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "date": "2014-07-23T20:49:08",
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "date": "2014-07-23T20:48:33",
        "db": "PACKETSTORM",
        "id": "127585"
      },
      {
        "date": "2014-07-20T11:12:48.823000",
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "date": "2014-07-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-18T00:00:00",
        "db": "ZDI",
        "id": "ZDI-14-239"
      },
      {
        "date": "2019-08-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-67610"
      },
      {
        "date": "2015-05-07T17:32:00",
        "db": "BID",
        "id": "68740"
      },
      {
        "date": "2015-05-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      },
      {
        "date": "2023-11-07T02:18:09.703000",
        "db": "NVD",
        "id": "CVE-2014-0117"
      },
      {
        "date": "2021-06-07T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "127586"
      },
      {
        "db": "PACKETSTORM",
        "id": "127588"
      },
      {
        "db": "PACKETSTORM",
        "id": "127585"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ],
    "trust": 0.9
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apache HTTP Server of  mod_proxy Service disruption in modules  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003472"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-491"
      }
    ],
    "trust": 0.6
  }
}