NVD

CVE-2015-0253 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Description

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.

Evaluator Description

CWE-476: NULL Pointer Dereference

Severity

CVSS 3.x Severity and Metrics:

NIST: NVD

Base Score: N/A

NVD score not yet provided.

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html	Mailing List
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	Mailing List
http://rhn.redhat.com/errata/RHSA-2015-1666.html
http://www.apache.org/dist/httpd/CHANGES_2.4	Release Notes Vendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
http://www.securityfocus.com/bid/75964
http://www.securitytracker.com/id/1032967
https://bz.apache.org/bugzilla/show_bug.cgi?id=57531	Issue Tracking
https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb
https://github.com/apache/httpd/commit/be0f5335e3e73eb63253b050fdc23f252f5c8ae3
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://support.apple.com/HT205219	Third Party Advisory
https://support.apple.com/kb/HT205031	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Other	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

21 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2015-0253
NVD Published Date:
07/20/2015
NVD Last Modified:
06/06/2021
Source:
Red Hat, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2015-0253 Detail

Description

Evaluator Description

Severity

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by Red Hat, Inc. 6/06/2021 7:15:19 AM

CVE Modified by Red Hat, Inc. 6/03/2021 4:15:15 AM

CVE Modified by Red Hat, Inc. 3/30/2021 9:15:21 AM

CVE Modified by Red Hat, Inc. 3/30/2021 8:15:59 AM

CVE Modified by Red Hat, Inc. 10/27/2020 12:15:12 PM

CVE Modified by Red Hat, Inc. 4/01/2020 12:15:24 PM

CVE Modified by Red Hat, Inc. 4/01/2020 11:15:31 AM

CPE Deprecation Remap by NIST 12/27/2019 11:09:04 AM

CVE Modified by Red Hat, Inc. 8/15/2019 5:15:28 AM

CVE Modified by Red Hat, Inc. 1/04/2018 9:29:58 PM

CVE Modified by Red Hat, Inc. 9/21/2017 9:29:01 PM

CVE Modified by Red Hat, Inc. 11/28/2016 2:16:16 PM

Modified Analysis by NIST 10/20/2016 3:17:42 PM

Initial CVE Analysis 10/20/2016 1:44:21 PM

CVE Modified by Source 10/17/2016 11:45:30 PM

CVE Modified by Source 10/11/2016 9:59:59 PM

Modified Analysis by NIST 7/08/2016 2:49:26 PM

CVE Modified by Source 9/18/2015 9:59:52 PM

CVE Modified by Source 8/17/2015 10:00:15 PM

Modified Analysis by NIST 7/21/2015 11:57:00 AM

Initial CVE Analysis 7/21/2015 11:18:27 AM

Quick Info