CVE-2011-4362: debian debian_linux

Modified

AliasesDEBIAN-CVE-2011-4362

Published 24-12-2011Last modified 07-08-2024

Vulnerability summary

CVE-2011-4362 is a medium (CVSS 5.0) vulnerability in debian debian_linux. EPSS estimates a 21.11% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 6 public exploits are recorded.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

21.11%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits6reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

DSA-2368-1 OPENSUSE-SU-2024:10402-1

Timeline

24-12-2011
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

21.11%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 21.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

6 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (blog.pi3.com.pl)
Maturity: unknown
referenceUnverified
Exploit Reference (download.lighttpd.net)
Maturity: unknown

Show all 6 exploits

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (redmine.lighttpd.net)
Maturity: unknown
exploit-databasedoslinuxVerified
lighttpd - Denial of Service (PoC)
Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian2 products

lighttpd< 1.4.30-1
debian_linuxEOL5.0 | 6.0 | 7.0

Lighttpd1 product

lighttpd≥ 1.4.1, < 1.4.30 | 1.5.0

2 vendors · 3 products

References

14 links

secunia.com/advisories/47260Third Party AdvisoryX Refsource SECUNIA
archives.neohapsis.com/archives/bugtraq/2011-12/0167.htmlMailing ListX Refsource BUGTRAQBroken Link
www.openwall.com/lists/oss-security/2011/11/29/8Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=758624X Refsource CONFIRMIssue TrackingThird Party Advisory
www.debian.org/security/2011/dsa-2368Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.exploit-db.com/exploits/18295ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
blog.pi3.com.pl?p=277X Refsource MISCExploitThird Party Advisory
download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txtX Refsource CONFIRMExploitPatchVendor Advisory
www.openwall.com/lists/oss-security/2011/11/29/13Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
www.securitytracker.com/id?1026359VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 14 references

exchange.xforce.ibmcloud.com/vulnerabilities/71536VDB EntryX Refsource XFThird Party Advisory
redmine.lighttpd.net/issues/2370X Refsource CONFIRMExploitPatchVendor Advisory
jvn.jp/en/jp/JVN37417423/index.htmlThird Party AdvisoryX Refsource JVN
security-tracker.debian.org/tracker/CVE-2011-4362Advisory