Search CVE reports

21 – 30 of 294 results

Detailed view

Sort by:

CVE-2023-52426

Medium priority

Some fixes available 2 of 50

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

23 affected packages

apache2, apr-util, ayttm, cableswig, cadaver...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cmake	Not affected	Not affected	Not affected	Not affected
coin3	Not affected	Not affected	Not affected	Needs evaluation
expat	Fixed	Not affected	Not affected	Not affected
firefox	Not affected	Not affected	Not affected	Ignored
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Not affected	Not affected	Not affected	Not affected
matanza	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
smart	Not in release	Not in release	Not in release	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
thunderbird	Not affected	Not affected	Not affected	Ignored
vnc4	Not in release	Not in release	Not in release	Not affected
vtk	Not in release	Not in release	Not in release	Not in release
wbxml2	Needs evaluation	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Not affected	Not affected	Not affected

CVE-2023-52425

Medium priority

Some fixes available 4 of 77

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

23 affected packages

apache2, apr-util, ayttm, cableswig, cadaver...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cmake	Not affected	Not affected	Not affected	Not affected
coin3	Not affected	Not affected	Not affected	Needs evaluation
expat	Fixed	Fixed	Ignored	Ignored
firefox	Not affected	Not affected	Not affected	Ignored
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Ignored	Ignored	Ignored	Ignored
matanza	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
smart	Not in release	Not in release	Not in release	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
thunderbird	Not affected	Not affected	Not affected	Ignored
vnc4	Not in release	Not in release	Not in release	Needs evaluation
vtk	Not in release	Not in release	Not in release	Not in release
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-45802

Medium priority

Some fixes available 6 of 7

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request’s memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Needs evaluation

CVE-2023-43622

Low priority

Fixed

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Not affected	Not affected	Not affected

CVE-2023-31122

Low priority

Fixed

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Fixed	Fixed	Fixed

CVE-2023-28625

Medium priority

Needs evaluation

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a...

1 affected package

libapache2-mod-auth-openidc

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
libapache2-mod-auth-openidc	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-27522

Medium priority

Fixed

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	Fixed	Fixed	Not affected

CVE-2023-25690

Medium priority

Some fixes available 9 of 10

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Fixed

CVE-2022-37436

Medium priority

Some fixes available 9 of 10

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose,...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Fixed

CVE-2022-36760

Medium priority

Some fixes available 9 of 10

Inconsistent Interpretation of HTTP Requests (‘HTTP Request Smuggling’) vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects...

1 affected package

apache2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Fixed	Fixed	Fixed	Fixed

Export to JSON

Results by page: