CVE-2008-1111: lighttpd

EPSS trend

Probability

2.02%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

0.00 pp

From 2.02% on 21-09-2026

21-09-202621-10-2026

EPSS score

2.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

20 links

secunia.com/advisories/29268Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29622Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/0763VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/29318Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/29209Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2008/dsa-1513Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.htmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/bid/28100VDB EntryX Refsource BID
www.securityfocus.com/archive/1/489465/100/0/threadedMailing ListX Refsource BUGTRAQ

Show all 20 references

secunia.com/advisories/29275Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security.gentoo.org/glsa/glsa-200803-10.xmlVendor AdvisoryX Refsource GENTOO
issues.rpath.com/browse/RPL-2326X Refsource MISC
bugs.gentoo.org/show_bug.cgi?id=211956X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.htmlVendor AdvisoryX Refsource FEDORA
trac.lighttpd.net/trac/changeset/2107X Refsource CONFIRM
secunia.com/advisories/29235Third Party AdvisoryX Refsource SECUNIAVendor Advisory
wiki.rpath.com/wiki/Advisories:rPSA-2008-0106X Refsource MISC
exchange.xforce.ibmcloud.com/vulnerabilities/41008VDB EntryX Refsource XF
security-tracker.debian.org/tracker/CVE-2008-1111Advisory

Related vulnerabilities

CVE-2018-19052debianlighttpd+1013.71%7y ago07-11-2018 05:00An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.CVE-2018-25103debianlighttpd+20.67%2y ago17-06-2024 18:02There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.CVE-2013-1427debianlighttpd+20.35%13y ago21-03-2013 17:00The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.CVE-2013-4560debianlighttpd+45.42%12y ago19-11-2013 19:00Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.CVE-2013-4508debianlighttpd+42.63%12y ago08-11-2013 02:00lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.CVE-2013-4559debianlighttpd+410.72%12y ago19-11-2013 19:00lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

All vulnerabilities inlighttpd

CVE-2008-1111: lighttpd

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References