CVE-2014-0242

NameCVE-2014-0242
Descriptionmod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2937-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mod-wsgi (PTS)bullseye4.7.1-3+deb11u1fixed
bookworm4.9.4-1fixed
sid, trixie5.0.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mod-wsgisourcesqueeze3.3-2+deb6u1DSA-2937-1
mod-wsgisourcewheezy3.3-4+deb7u1DSA-2937-1
mod-wsgisource(unstable)3.4-3

Notes

https://github.com/GrahamDumpleton/mod_wsgi/commit/b0a149c1f5e569932325972e2e20176a42e43517

Search for package or bug name: Reporting problems