CVE-2014-3581: Null Pointer Dereference
It was reported that if Content-Type header value is empty, httpd with modcache enabled will segfault: https://issues.apache.org/bugzilla/showbug.cgi?id=56924
Upstream patch: http://svn.apache.org/viewvc?view=revision&revision=1624234
Other sources
The cachemergeheadersout function in modules/cache/cacheutil.c in the modcache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3581?
CVE-2014-3581 is classified as a critical severity vulnerability.
How do I fix CVE-2014-3581?
To fix CVE-2014-3581, upgrade to Apache HTTP Server version 2.4.11 or later.
What systems are affected by CVE-2014-3581?
CVE-2014-3581 affects Apache HTTP Server versions from 2.4.1 to 2.4.10.
What happens if CVE-2014-3581 is exploited?
Exploitation of CVE-2014-3581 can lead to a segmentation fault and denial of service.
Is CVE-2014-3581 related to mod_cache?
Yes, CVE-2014-3581 is specifically related to the mod_cache feature in Apache HTTP Server.