Red Hat Security Advisory: httpd security update

Important

A heap overflow flaw was found In Apache httpd mod_session. The highest threat from this vulnerability is to system availability.

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

A NULL pointer dereference in httpd allows an unauthenticated remote attacker to crash httpd by providing malformed HTTP requests. The highest threat from this vulnerability is to system availability.

CWE-476 - NULL Pointer Dereference

An out-of-bounds write in function ap_escape_quotes of httpd allows an unauthenticated remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function.

CWE-787 - Out-of-bounds Write

A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability.

CWE-787 - Out-of-bounds Write