CVE-2007-1869: lighttpd

EPSS trend

Probability

3.38%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.38% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

15 links

secunia.com/advisories/25613Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200705-07.xmlVendor AdvisoryX Refsource GENTOO
www.vupen.com/english/advisories/2007/1399VDB EntryX Refsource VUPEN
secunia.com/advisories/24947Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2007_007_suse.htmlVendor AdvisoryX Refsource SUSE
exchange.xforce.ibmcloud.com/vulnerabilities/33671VDB EntryX Refsource XF
secunia.com/advisories/24995Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-1218X Refsource CONFIRM
www.debian.org/security/2007/dsa-1303Vendor AdvisoryX Refsource DEBIAN
www.securityfocus.com/bid/23515VDB EntryX Refsource BID

Show all 15 references

www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txtX Refsource CONFIRMPatchVendor Advisory
www.securityfocus.com/archive/1/466464/30/6900/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/25166Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/24886Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security-tracker.debian.org/tracker/CVE-2007-1869Advisory

Related vulnerabilities

CVE-2018-19052debianlighttpd+1013.71%7y ago07-11-2018 05:00An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.CVE-2018-25103debianlighttpd+20.67%2y ago17-06-2024 18:02There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.CVE-2013-1427debianlighttpd+20.35%13y ago21-03-2013 17:00The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.CVE-2013-4560debianlighttpd+45.42%12y ago19-11-2013 19:00Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.CVE-2013-4508debianlighttpd+42.63%12y ago08-11-2013 02:00lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.CVE-2013-4559debianlighttpd+410.72%12y ago19-11-2013 19:00lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

All vulnerabilities inlighttpd

CVE-2007-1869: lighttpd

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References