CVE-2016-4975
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 a...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2016-4975 apache2 修正版: 2.4.25-1
参照URL
- advisory securityfocus.com
- advisory httpd.apache.org
- advisory httpd.apache.org
- advisory security.netapp.com
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web support.hpe.com