Summary
It was discovered that Lighttpd did not properly sanitized the string used in
basic HTTP authentication method. A remote attacker could use this to inject
arbitrary log entries and maybe obtain sensitive information. This issue only
affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)
It was discovered that Lighttpd did not properly sanitized the string used in
alias. A remote attacker could use this to access the content of the directory
above the alias and obtain sensitive information. (CVE-2018-19052)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | lighttpd | 1.4.33-1+nmu2ubuntu2.1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | lighttpd | 1.4.35-4ubuntu2.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | lighttpd | 1.4.45-1ubuntu3.18.04.1+esm1 |
Vulnerabilities 2
-
Unscored —
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authenticat…
-
Unscored —
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ …