CVE-2014-0242

NameCVE-2014-0242
Descriptionmod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2937-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mod-wsgi (PTS)stretch4.5.11-1fixed
buster4.6.5-1fixed
bullseye, sid4.6.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mod-wsgisource(unstable)3.4-3
mod-wsgisourcesqueeze3.3-2+deb6u1DSA-2937-1
mod-wsgisourcewheezy3.3-4+deb7u1DSA-2937-1

Notes

https://github.com/GrahamDumpleton/mod_wsgi/commit/b0a149c1f5e569932325972e2e20176a42e43517

Search for package or bug name: Reporting problems