CVE-2015-3183

Publication date 20 July 2015

Last updated 24 July 2024

Ubuntu priority

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	15.04 vivid	Fixed 2.4.10-9ubuntu1.1
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Fixed 2.4.7-1ubuntu4.5
	12.04 LTS precise	Fixed 2.2.22-1ubuntu1.10

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: http://svn.apache.org/viewvc?view=revision&revision=1684513 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685339 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685345 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685347 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688536 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688538 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1684515 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685904 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685950 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1686271 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688935 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1689821 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1687338 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1687339 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688936 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1689522

Package

Patch details

apache2

Upstream: http://svn.apache.org/viewvc?view=revision&revision=1684513
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685339
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685345
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685347
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688536
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688538
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1684515
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685904
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1685950
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1686271
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688935
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1689821
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1687338
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1687339
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1688936
Upstream: http://svn.apache.org/viewvc?view=revision&revision=1689522

References

Related Ubuntu Security Notices (USN)

USN-2686-1
Apache HTTP Server vulnerabilities
27 July 2015

CVE-2015-3183

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references