CVE-2011-4362

Aliases:DEBIAN-CVE-2011-4362
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 24 Dec 2011, 19:00
Last modified:07 Aug 2024, 00:09

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
5 MEDIUM
v2.0 (nvd)
EPSS Score
21.11% HIGH
21% probability +17.46%
KEV
Not listed
Ransomware
No reports
Public exploits
6 found
Dark Web
Not detected

Timeline

24 Dec 2011, 19:00
Published
Vulnerability first disclosed
07 Aug 2024, 00:09
Last Modified
Vulnerability information updated

Description

Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.

CVSS Metrics

  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 21.11%• Percentile: 97%

Affected Systems

  • debian•lighttpd

    < 1.4.30-1 | < 1.4.30-1 | < 1.4.30-1 | < 1.4.30-1

  • debian•debian_linux

    5.0 | 6.0 | 7.0

  • lighttpd•lighttpd

    ≥ 1.4.1, < 1.4.30 | 1.5.0

References (14)