CVE-2014-0098
Fixed in a distro release EPSS 27%
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
Products: apache http_server, oracle http_server, oracle secure_global_desktop, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.9-1 |
| Debian 13 | apache2 | 2.4.9-1 |
| Debian 14 | apache2 | 2.4.9-1 |
| Red Hat Enterprise Linux 5 | httpd | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-debuginfo | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-devel | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | httpd-manual | 0:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 5 | mod_ssl | 1:2.2.3-85.el5_10 |
| Red Hat Enterprise Linux 6 | httpd | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-debuginfo | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-devel | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-manual | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | httpd-tools | 0:2.2.15-30.el6_5 |
| Red Hat Enterprise Linux 6 | mod_ssl | 1:2.2.15-30.el6_5 |
| Red Hat jboss enterprise application platform 6 | httpd | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-debuginfo | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd-debuginfo | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-devel | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-devel | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | httpd-tools | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | httpd-tools | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | mod_ssl | 1:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | mod_ssl | 1:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-debuginfo | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.22-27.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.22-27.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.22-27.ep6.el5 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |