CVE-2011-4362
Published: 24 December 2011
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Priority
Status
Package | Release | Status |
---|---|---|
lighttpd Launchpad, Ubuntu, Debian |
hardy |
Ignored
(end of life)
|
lucid |
Released
(1.4.26-1.1ubuntu3.1)
|
|
maverick |
Released
(1.4.26-3ubuntu2.1)
|
|
natty |
Released
(1.4.28-2ubuntu1.1)
|
|
oneiric |
Released
(1.4.28-2ubuntu2.1)
|
|
upstream |
Released
(1.4.30)
|
|
Patches: upstream: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt debdiff: https://launchpad.net/bugs/906792 |