PT-2010-5132 · Apache · Httpd

Jeff Trawick · Published 2010-11-20 · Updated 2024-06-15 · CVE-2010-3872

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions httpd (affected versions not specified)

Description A flaw was found in the mod fcgid module of httpd, where a malformed FastCGI response may cause a stack-based buffer overflow in the fcgid header bucket read() function, potentially resulting in an application crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-189

CWE-121

Related Identifiers

CVE-2010-3872

DSA-2140-1

OPENSUSE-SU-2024:10564-1

Affected Products

Httpd

References · 28

• https://security-tracker.debian.org/tracker/CVE-2010-3872 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050976.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00005.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050930.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3872 · Security Note
• http://secunia.com/advisories/42302 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2998 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10564-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3872 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00004.html · Vendor Advisory
• https://issues.apache.org/bugzilla/show_bug.cgi?id=49406 · Patch
• https://osv.dev/vulnerability/CVE-2010-3872 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050932.html · Vendor Advisory
• http://secunia.com/advisories/42288 · Vendor Advisory
• http://debian.org/security/2010/dsa-2140 · Vendor Advisory