CVE-2014-2323
Fixed in a distro release EPSS 63%
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
Products: lighttpd, debian_linux, opensuse, suse linux_enterprise_high_availability_extension, suse linux_enterprise_software_development_kit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lighttpd | 1.4.33-1+nmu3 |
| Debian 13 | lighttpd | 1.4.33-1+nmu3 |
| Debian 14 | lighttpd | 1.4.33-1+nmu3 |
| Debian 6.0 | lighttpd | 1.4.28-2+squeeze1.6 |
| Debian 7 | lighttpd | 1.4.31-4+deb7u3 |
| Ubuntu 14.04 LTS | lighttpd | 1.4.33-1+nmu2ubuntu2.1 |
| openSUSE Tumbleweed | lighttpd | 1.4.37-1.6 |