CVE-2007-3950: Medium severity Lighttpd Lighttpd vulnerability
Published Jul 24, 2007
·Updated
lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) modscgi, (2) modfastcgi, and (3) modwebdav modules.
Affected Software
1 affected component
Lighttpd Lighttpd<=1.4.15
Remediation
Patch Available
Event History
Jul 24, 2007
CVE Published
12:30 AM
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-3950?
CVE-2007-3950 is classified as a denial of service vulnerability.
2
How do I fix CVE-2007-3950?
To fix CVE-2007-3950, it is recommended to upgrade Lighttpd to a version later than 1.4.15.
3
Which versions of Lighttpd are affected by CVE-2007-3950?
Lighttpd versions up to and including 1.4.15 are affected by CVE-2007-3950.
4
What modules in Lighttpd are involved in CVE-2007-3950?
CVE-2007-3950 involves the mod_scgi, mod_fastcgi, and mod_webdav modules.
5
What type of attack does CVE-2007-3950 enable?
CVE-2007-3950 enables remote attackers to cause a denial of service by crashing the Lighttpd daemon.