CVE-2014-2324
Fixed in a distro release EPSS 30%
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
Products: lighttpd, debian_linux, opensuse, suse linux_enterprise_high_availability_extension, suse linux_enterprise_software_development_kit, contec sv-cpt-mc310_firmware
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lighttpd | 1.4.33-1+nmu3 |
| Debian 13 | lighttpd | 1.4.33-1+nmu3 |
| Debian 14 | lighttpd | 1.4.33-1+nmu3 |
| Debian 6.0 | lighttpd | 1.4.28-2+squeeze1.6 |
| Debian 7 | lighttpd | 1.4.31-4+deb7u3 |
| Ubuntu 14.04 LTS | lighttpd | 1.4.33-1+nmu2ubuntu2.1 |
| openSUSE Tumbleweed | lighttpd | 1.4.37-1.6 |