CVE-2015-0253
Fixed in a distro release EPSS 13%
The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Products: apache http_server, apple mac_os_x, apple mac_os_x_server, oracle linux, oracle solaris
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.12-6.el7.1 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.12-4.el6.2 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.12-6.el7.1 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |