CVE-2014-3581
Fixed in a distro release EPSS 14%
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.
Products: apache http_server, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, oracle enterprise_manager_ops_center, oracle linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.10-3 |
| Debian 13 | apache2 | 2.4.10-3 |
| Debian 14 | apache2 | 2.4.10-3 |
| Debian 6.0 | apache2 | 2.2.16-6+squeeze14 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-31.el7 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el6 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el7 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el6 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx | 0:0.9.5-7.GA.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx | 0:0.9.5-7.GA.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx-debuginfo | 0:0.9.5-7.GA.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx-debuginfo | 0:0.9.5-7.GA.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native | 0:1.3.1-6.Final_redhat_2.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native | 0:1.3.1-6.Final_redhat_2.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native-debuginfo | 0:1.3.1-6.Final_redhat_2.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native-debuginfo | 0:1.3.1-6.Final_redhat_2.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat-vault | 0:1.0.8-4.Final_redhat_4.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat-vault | 0:1.0.8-4.Final_redhat_4.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-debuginfo | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-debuginfo | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-devel | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-devel | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-manual | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-manual | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-tools | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-tools | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_ldap | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_ldap | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_proxy_html | 1:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_proxy_html | 1:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_session | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_session | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_ssl | 1:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_ssl | 1:2.4.6-25.el7 |
| SUSE Linux Enterprise Server 12 | apache2 | 2.4.10-12.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | apache2 | 2.4.10-12.1 |
| SUSE Linux Enterprise Software Development Kit 12 | apache2 | 2.4.10-12.1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.4 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |