Unscored DSA-2795-1 3 CVEs

lighttpd - several

Published Nov 13, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 6.0	lighttpd	1.4.28-2+squeeze1.4
Debian · 7	lighttpd	1.4.31-4+deb7u1

Vulnerabilities 3

Unscored —

CVE-2013-4508

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to…

lighttpd Debian

Nov 8, 2013
Unscored —

CVE-2013-4559 EPSS 11%

lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which…

lighttpd Debian

Nov 19, 2013
Unscored —

CVE-2013-4560

Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentati…

lighttpd Debian

Nov 19, 2013