Apache Httpd < 2.0.64 : expat DoS

2009-08-2100:00:00

Apache Team Foundation

httpd.apache.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.027

Percentile

90.6%

JSON

A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document (for example through mod_dav) may be able to cause a crash. This crash would only be a denial of service if using the worker MPM.

Affected configurations

Vulners

Node

apacheapache_httpdMatch2.0.63

apacheapache_httpdMatch2.0.61

apacheapache_httpdMatch2.0.59

apacheapache_httpdMatch2.0.58

apacheapache_httpdMatch2.0.55

apacheapache_httpdMatch2.0.54

apacheapache_httpdMatch2.0.53

apacheapache_httpdMatch2.0.52

apacheapache_httpdMatch2.0.51

apacheapache_httpdMatch2.0.50

apacheapache_httpdMatch2.0.49

apacheapache_httpdMatch2.0.48

apacheapache_httpdMatch2.0.47

apacheapache_httpdMatch2.0.46

apacheapache_httpdMatch2.0.45

apacheapache_httpdMatch2.0.44

apacheapache_httpdMatch2.0.43

apacheapache_httpdMatch2.0.42

apacheapache_httpdMatch2.0.40

apacheapache_httpdMatch2.0.39

apacheapache_httpdMatch2.0.37

apacheapache_httpdMatch2.0.36

apacheapache_httpdMatch2.0.35

VendorProductVersionCPE
apacheapache_httpd2.0.63cpe:2.3:a:apache:apache_httpd:2.0.63:*:*:*:*:*:*:*
apacheapache_httpd2.0.61cpe:2.3:a:apache:apache_httpd:2.0.61:*:*:*:*:*:*:*
apacheapache_httpd2.0.59cpe:2.3:a:apache:apache_httpd:2.0.59:*:*:*:*:*:*:*
apacheapache_httpd2.0.58cpe:2.3:a:apache:apache_httpd:2.0.58:*:*:*:*:*:*:*
apacheapache_httpd2.0.55cpe:2.3:a:apache:apache_httpd:2.0.55:*:*:*:*:*:*:*
apacheapache_httpd2.0.54cpe:2.3:a:apache:apache_httpd:2.0.54:*:*:*:*:*:*:*
apacheapache_httpd2.0.53cpe:2.3:a:apache:apache_httpd:2.0.53:*:*:*:*:*:*:*
apacheapache_httpd2.0.52cpe:2.3:a:apache:apache_httpd:2.0.52:*:*:*:*:*:*:*
apacheapache_httpd2.0.51cpe:2.3:a:apache:apache_httpd:2.0.51:*:*:*:*:*:*:*
apacheapache_httpd2.0.50cpe:2.3:a:apache:apache_httpd:2.0.50:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	apache_httpd	2.0.63	cpe:2.3:a:apache:apache_httpd:2.0.63:::::::*
apache	apache_httpd	2.0.61	cpe:2.3:a:apache:apache_httpd:2.0.61:::::::*
apache	apache_httpd	2.0.59	cpe:2.3:a:apache:apache_httpd:2.0.59:::::::*
apache	apache_httpd	2.0.58	cpe:2.3:a:apache:apache_httpd:2.0.58:::::::*
apache	apache_httpd	2.0.55	cpe:2.3:a:apache:apache_httpd:2.0.55:::::::*
apache	apache_httpd	2.0.54	cpe:2.3:a:apache:apache_httpd:2.0.54:::::::*
apache	apache_httpd	2.0.53	cpe:2.3:a:apache:apache_httpd:2.0.53:::::::*
apache	apache_httpd	2.0.52	cpe:2.3:a:apache:apache_httpd:2.0.52:::::::*
apache	apache_httpd	2.0.51	cpe:2.3:a:apache:apache_httpd:2.0.51:::::::*
apache	apache_httpd	2.0.50	cpe:2.3:a:apache:apache_httpd:2.0.50:::::::*