CVE-2010-0434

Publication date 5 March 2010

Last updated 24 July 2024

Ubuntu priority

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
apache2	9.10 karmic	Fixed 2.2.12-1ubuntu2.2
	9.04 jaunty	Fixed 2.2.11-2ubuntu2.6
	8.10 intrepid	Fixed 2.2.9-7ubuntu3.6
	8.04 LTS hardy	Fixed 2.2.8-1ubuntu0.15
	6.06 LTS dapper	Fixed 2.0.55-4ubuntu2.10

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: http://svn.apache.org/viewvc?view=revision&revision=917867 Upstream: http://svn.apache.org/viewvc?view=revision&revision=918427

References

Related Ubuntu Security Notices (USN)

USN-908-1
Apache vulnerabilities
10 March 2010

CVE-2010-0434

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references