CVE-2013-6438
Fixed in a distro release EPSS 27%
The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
Products: apache http_server, oracle http_server, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.9-1 |
| Debian 13 | apache2 | 2.4.9-1 |
| Debian 14 | apache2 | 2.4.9-1 |
| Debian 6.0 | apache2 | 2.2.16-6+squeeze13 |
| Red Hat Enterprise Linux 5 | httpd | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-debuginfo | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-devel | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-manual | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | mod_ssl | 1:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 6 | httpd | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-debuginfo | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-devel | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-manual | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-tools | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | mod_ssl | 1:2.2.15-30.el6_5 |
| Red Hat jboss enterprise application platform 6 | httpd | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-debuginfo | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd-debuginfo | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-devel | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-devel | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd-tools | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-tools | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | mod_ssl | 1:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | mod_ssl | 1:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-debuginfo | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.22-27.ep6.el5 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |