Unscored DSA-3896-1 4 CVEs

apache2 - security update

Published Jun 22, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 8	apache2	2.4.10-10+deb8u9
Debian · 9	apache2	2.4.25-3+deb9u1

Vulnerabilities 4

Unscored —

CVE-2017-3167 EPSS 20%

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules o…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 20, 2017
Unscored —

CVE-2017-3169 EPSS 20%

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mo…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 20, 2017
Unscored —

CVE-2017-7668 EPSS 57%

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which a…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 20, 2017
Unscored —

CVE-2017-7679 Public exploit EPSS 39%

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when s…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 20, 2017