Published: 13/12/2013 Updated: 21/02/2014

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

The MHD_http_unescape function in libmicrohttpd prior to 0.9.32 might allow remote malicious users to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu libmicrohttpd 0.9.29
gnu libmicrohttpd 0.9.28
gnu libmicrohttpd 0.9.21
gnu libmicrohttpd 0.9.20
gnu libmicrohttpd
gnu libmicrohttpd 0.9.30
gnu libmicrohttpd 0.9.23
gnu libmicrohttpd 0.9.22
gnu libmicrohttpd 0.9.25
gnu libmicrohttpd 0.9.24
gnu libmicrohttpd 0.9.17
gnu libmicrohttpd 0.9.16
gnu libmicrohttpd 0.9.27
gnu libmicrohttpd 0.9.26
gnu libmicrohttpd 0.9.19
gnu libmicrohttpd 0.9.18

Debian Bug report logs - #731933 libmicrohttpd: CVE-2013-7038 CVE-2013-7039 Package: libmicrohttpd; Maintainer for libmicrohttpd is Bertrand Marc <bmarc@debianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Wed, 11 Dec 2013 11:54:02 UTC Severity: grave Tags: security Fixed in versions libmicrohttpd/09 ...

Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0932, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header The MHD_http_unescape function in libmicrohttpd ...

The MHD_http_unescape function in libmicrohttpd before 0932 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read ...

CWE-119 https://bugs.gentoo.org/show_bug.cgi?id=493450 http://www.securityfocus.com/bid/64138 http://www.openwall.com/lists/oss-security/2013/12/09/11 https://bugzilla.redhat.com/show_bug.cgi?id=1039384 https://gnunet.org/svn/libmicrohttpd/ChangeLog http://secunia.com/advisories/55903 http://security.gentoo.org/glsa/glsa-201402-01.xml https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731933 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-7038 https://alas.aws.amazon.com/ALAS-2014-353.html

CVE-2013-7038

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect