lighttpd 1.4.18
Approved changes feed: RSS · Atom
cpe:2.3:a:lighttpd:lighttpd:1.4.18:*:*:*:*:*:*:*
part: a version: 1.4.18 update: *
| Vendor | Lighttpd (5206741e-6b14-56e0-b31f-406bdf611784) |
|---|---|
| Product | Lighttpd (5b6699d9-10ff-598e-a44b-38df5dc45b39) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/lighttpd |
purl2cpe | 2026-06-01 10:17:10.755727 |
pkg:deb/ubuntu/lighttpd |
purl2cpe | 2026-06-01 10:17:10.755728 |
pkg:github/lighttpd/lighttpd1.4 |
purl2cpe | 2026-06-01 10:17:10.755730 |
pkg:github/lighttpd/lighttpd2 |
purl2cpe | 2026-06-01 10:17:10.755731 |
pkg:rpm/fedora/lighttpd |
purl2cpe | 2026-06-01 10:17:10.755732 |
pkg:rpm/opensuse/lighttpd |
purl2cpe | 2026-06-01 10:17:10.755734 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2013-1427 |
vulnerable | 2026-06-08 05:03:53.910182 |
Details available
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
Published: 2013-03-21T17:00:00.000Z
Updated: 2024-08-06T15:04:48.266Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-0295 |
vulnerable | 2026-06-08 04:52:01.618408 |
Details available
lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.
Published: 2010-02-03T19:00:00.000Z
Updated: 2024-08-07T00:45:11.703Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-4298 |
vulnerable | 2026-06-08 04:50:38.537372 |
Details available
Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.
Published: 2008-09-27T00:00:00.000Z
Updated: 2024-08-07T10:08:34.967Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-1111 |
vulnerable | 2026-06-08 04:50:18.918471 |
Details available
mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.
Published: 2008-03-04T23:00:00.000Z
Updated: 2024-08-07T08:08:57.337Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-0983 |
vulnerable | 2026-06-08 04:50:18.515698 |
Details available
lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.
Published: 2008-02-26T18:00:00.000Z
Updated: 2024-08-07T08:01:40.227Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.