Summary
Róbert Kisteleki discovered mod_wsgi incorrectly checked setuid return
values. A malicious application could use this issue to cause a local
privilege escalation when using daemon mode. (CVE-2014-0240)
Buck Golemon discovered that mod_wsgi used memory that had been freed.
A remote attacker could use this issue to read process memory via the
Content-Type response header. This issue only affected Ubuntu 12.04 LTS.
(CVE-2014-0242)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | mod-wsgi | 3.4-4ubuntu2.1.14.04.1 |
Vulnerabilities 2
-
Unscored —
The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned b…
-
Unscored —CVE-2014-0242 Public exploit
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive inf…