CVE-2014-3581

Description

The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

References

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html

http://rhn.redhat.com/errata/RHSA-2015-0325.html

http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup&pathrev=1627749

http://svn.apache.org/viewvc?view=revision&revision=1624234

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/bid/71656

http://www.securitytracker.com/id/1031005

http://www.ubuntu.com/usn/USN-2523-1

https://bugzilla.redhat.com/show_bug.cgi?id=1149709

https://exchange.xforce.ibmcloud.com/vulnerabilities/97027

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://security.gentoo.org/glsa/201610-02

https://support.apple.com/HT205219

https://support.apple.com/kb/HT205031

Details

Risk Information

CVSS v2.0