CVE-2007-3847: apache http_server Out-of-bounds Read

Modified

AliasesRHSA-2007:0746RHSA-2007:0747DEBIAN-CVE-2007-3847

Published 23-08-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-3847 is a medium (CVSS 5.0) Out-of-bounds Read vulnerability in apache http_server. EPSS estimates a 12.90% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

12.90%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1

OPENSUSE-SU-2024:10623-1 RHSA-2007:0911 RHSA-2008:0005 RHSA-2010:0602

Timeline

23-08-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

12.90%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.90% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

httpd< 0:2.2.3-11.el5 | < 0:2.0.52-38.ent
httpd-debuginfo< 0:2.2.3-11.el5 | < 0:2.0.52-38.ent
httpd-devel< 0:2.2.3-11.el5 | < 0:2.0.52-38.ent
httpd-manual< 0:2.2.3-11.el5 | < 0:2.0.52-38.ent
httpd-suexec< 0:2.0.52-38.ent

Show all 6

Fedoraproject2 products

fedoraEOL7
fedora_core6

Apache1 product

http_server≥ 2.0.35, < 2.0.61 | ≥ 2.2.0, < 2.2.6

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04 | 7.10

Debian1 product

apache2< 2.2.6-1

5 vendors · 11 products

References

104 links

secunia.com/advisories/28606Third Party AdvisoryX Refsource SECUNIANot Applicable
www.redhat.com/support/errata/RHSA-2008-0005.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.vupen.com/english/advisories/2007/3955VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/28922Third Party AdvisoryX Refsource SECUNIANot Applicable
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10525VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/28749Third Party AdvisoryX Refsource SECUNIANot Applicable
www-1.ibm.com/support/docview.wss?uid=swg1PK52702Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01182588Vendor AdvisoryX Refsource HPBroken Link
secunia.com/advisories/26952Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/26993Third Party AdvisoryX Refsource SECUNIANot Applicable

Show all 100 references

slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748Vendor AdvisoryX Refsource SLACKWAREThird Party Advisory
secunia.com/advisories/26636Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/27563Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id?1018633VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/27732Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/27209Third Party AdvisoryX Refsource SECUNIANot Applicable
www.redhat.com/support/errata/RHSA-2007-0911.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
marc.info?l=apache-httpd-dev&m=118595953217856&w=2Mailing ListX Refsource MLISTIssue TrackingThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/26790Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=apache-httpd-dev&m=118595556504202&w=2Mailing ListX Refsource MLISTIssue TrackingThird Party Advisory
www.vupen.com/english/advisories/2008/0924/referencesVDB EntryX Refsource VUPENPermissions Required
httpd.apache.org/security/vulnerabilities_20.htmlX Refsource CONFIRMVendor Advisory
www.us-cert.gov/cas/techalerts/TA08-150A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.novell.com/linux/security/advisories/2007_61_apache2.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-0747.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.vupen.com/english/advisories/2007/3494VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/29420Third Party AdvisoryX Refsource SECUNIANot Applicable
httpd.apache.org/security/vulnerabilities_22.htmlX Refsource CONFIRMVendor Advisory
issues.rpath.com/browse/RPL-1710X Refsource CONFIRMBroken Link
lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
secunia.com/advisories/30430Third Party AdvisoryX Refsource SECUNIANot Applicable
www.mandriva.com/security/advisories?name=MDKSA-2007:235Vendor AdvisoryX Refsource MANDRIVABroken Link
lists.apple.com/archives/security-announce/2008//May/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
support.avaya.com/elmodocs2/security/ASA-2007-500.htmX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/archive/1/505990/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/28467Third Party AdvisoryX Refsource SECUNIANot Applicable
www.vupen.com/english/advisories/2008/0233VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/26722Third Party AdvisoryX Refsource SECUNIANot Applicable
www.fujitsu.com/global/support/software/security/products-f/interstage-200802e.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/27971Third Party AdvisoryX Refsource SECUNIANot Applicable
lists.vmware.com/pipermail/security-announce/2009/000062.htmlMailing ListX Refsource MLISTThird Party Advisory
secunia.com/advisories/27882Third Party AdvisoryX Refsource SECUNIANot Applicable
security.gentoo.org/glsa/glsa-200711-06.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.vupen.com/english/advisories/2007/3095VDB EntryX Refsource VUPENPermissions Required
www-1.ibm.com/support/docview.wss?rs=180&uid=swg27007951X Refsource CONFIRMThird Party Advisory
docs.info.apple.com/article.html?artnum=307562X Refsource CONFIRMBroken Link
www.redhat.com/support/errata/RHSA-2007-0746.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www-1.ibm.com/support/docview.wss?uid=swg1PK50469Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
secunia.com/advisories/27593Third Party AdvisoryX Refsource SECUNIANot Applicable
www.vupen.com/english/advisories/2008/1697VDB EntryX Refsource VUPENPermissions Required
www.ubuntu.com/usn/usn-575-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/26842Third Party AdvisoryX Refsource SECUNIANot Applicable
www.vupen.com/english/advisories/2007/3283VDB EntryX Refsource VUPENPermissions Required
www.vupen.com/english/advisories/2007/3020VDB EntryX Refsource VUPENPermissions Required
www.securityfocus.com/bid/25489VDB EntryX Refsource BIDThird Party Advisory
marc.info?l=apache-cvs&m=118592992309395&w=2Mailing ListX Refsource MLISTIssue TrackingThird Party Advisory
bugs.gentoo.org/show_bug.cgi?id=186219X Refsource CONFIRMIssue TrackingThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
access.redhat.com/errata/RHSA-2007:0746Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=240024REPORT
bugzilla.redhat.com/show_bug.cgi?id=240857REPORT
bugzilla.redhat.com/show_bug.cgi?id=241680REPORT
bugzilla.redhat.com/show_bug.cgi?id=245719REPORT
bugzilla.redhat.com/show_bug.cgi?id=245763REPORT
bugzilla.redhat.com/show_bug.cgi?id=250731REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0746.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-3847REPORT
www.cve.org/CVERecord?id=CVE-2007-3847Advisory
nvd.nist.gov/vuln/detail/CVE-2007-3847Advisory
access.redhat.com/errata/RHSA-2007:0747Advisory
bugzilla.redhat.com/show_bug.cgi?id=173467REPORT
bugzilla.redhat.com/show_bug.cgi?id=197915REPORT
bugzilla.redhat.com/show_bug.cgi?id=233254REPORT
bugzilla.redhat.com/show_bug.cgi?id=240022REPORT
bugzilla.redhat.com/show_bug.cgi?id=241407REPORT

Showing 100 of 104.