[gentoo-announce] [ GLSA 201406-10 ] lighttpd: Multiple vulnerabilities - gentoo-announce

From:	Sergey Popov <pinkbyte@g.o>
To:	gentoo-announce@g.o
Subject:	[gentoo-announce] [ GLSA 201406-10 ] lighttpd: Multiple vulnerabilities
Date:	Fri, 13 Jun 2014 21:19:32
Message-Id:	`539B6282.7000801@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201406-10

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                            http://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: High

8

    Title: lighttpd: Multiple vulnerabilities

9

     Date: June 13, 2014

10

     Bugs: #392581, #444179, #490432, #491154, #504330

11

       ID: 201406-10

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in lighttpd, allowing remote

19

attackers cause a Denial of Service condition or execute arbitrary SQL

20

statements.

21

22

Background

23

==========

24

25

lighttpd is a lightweight high-performance web server.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  www-servers/lighttpd         < 1.4.35                  >= 1.4.35

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in lighttpd. Please

39

review the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

A remote attacker could create a Denial of Service condition.

45

Futhermore, a remote attacker may be able to execute arbitrary SQL

46

statements.

47

48

Workaround

49

==========

50

51

There is no known workaround at this time.

52

53

Resolution

54

==========

55

56

All lighttpd users should upgrade to the latest version:

57

58

  # emerge --sync

59

  # emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.35"

60

61

References

62

==========

63

64

[ 1 ] CVE-2011-4362

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4362

66

[ 2 ] CVE-2012-5533

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5533

68

[ 3 ] CVE-2013-4508

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4508

70

[ 4 ] CVE-2013-4559

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4559

72

[ 5 ] CVE-2013-4560

73

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4560

74

[ 6 ] CVE-2014-2323

75

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2323

76

77

Availability

78

============

79

80

This GLSA and any updates to it are available for viewing at

81

the Gentoo Security Website:

82

83

 http://security.gentoo.org/glsa/glsa-201406-10.xml

84

85

Concerns?

86

=========

87

88

Security is a primary focus of Gentoo Linux and ensuring the

89

confidentiality and security of our users' machines is of utmost

90

importance to us. Any security concerns should be addressed to

91

security@g.o or alternatively, you may file a bug at

92

https://bugs.gentoo.org.

93

94

License

95

=======

96

97

Copyright 2014 Gentoo Foundation, Inc; referenced text

98

belongs to its owner(s).

99

100

The contents of this document are licensed under the

101

Creative Commons - Attribution / Share Alike license.

102

103

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201406-10
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	http://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: High
8	Title: lighttpd: Multiple vulnerabilities
9	Date: June 13, 2014
10	Bugs: #392581, #444179, #490432, #491154, #504330
11	ID: 201406-10
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in lighttpd, allowing remote
19	attackers cause a Denial of Service condition or execute arbitrary SQL
20	statements.
21
22	Background
23	==========
24
25	lighttpd is a lightweight high-performance web server.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 www-servers/lighttpd < 1.4.35 >= 1.4.35
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in lighttpd. Please
39	review the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	A remote attacker could create a Denial of Service condition.
45	Futhermore, a remote attacker may be able to execute arbitrary SQL
46	statements.
47
48	Workaround
49	==========
50
51	There is no known workaround at this time.
52
53	Resolution
54	==========
55
56	All lighttpd users should upgrade to the latest version:
57
58	# emerge --sync
59	# emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.35"
60
61	References
62	==========
63
64	[ 1 ] CVE-2011-4362
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4362
66	[ 2 ] CVE-2012-5533
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5533
68	[ 3 ] CVE-2013-4508
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4508
70	[ 4 ] CVE-2013-4559
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4559
72	[ 5 ] CVE-2013-4560
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4560
74	[ 6 ] CVE-2014-2323
75	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2323
76
77	Availability
78	============
79
80	This GLSA and any updates to it are available for viewing at
81	the Gentoo Security Website:
82
83	http://security.gentoo.org/glsa/glsa-201406-10.xml
84
85	Concerns?
86	=========
87
88	Security is a primary focus of Gentoo Linux and ensuring the
89	confidentiality and security of our users' machines is of utmost
90	importance to us. Any security concerns should be addressed to
91	security@g.o or alternatively, you may file a bug at
92	https://bugs.gentoo.org.
93
94	License
95	=======
96
97	Copyright 2014 Gentoo Foundation, Inc; referenced text
98	belongs to its owner(s).
99
100	The contents of this document are licensed under the
101	Creative Commons - Attribution / Share Alike license.
102
103	http://creativecommons.org/licenses/by-sa/2.5