CVE-2019-11072: Integer Overflow
First published: Wed Apr 10 2019(Updated: )
** DISPUTED ** lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lighttpd Lighttpd | <=1.4.53 | |
| <=1.4.53 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11072?
CVE-2019-11072 is a vulnerability in lighttpd, an open-source web server, which allows remote attackers to cause a denial of service or possibly have other unspecified impacts.
What is the severity of CVE-2019-11072?
The severity of CVE-2019-11072 is critical, with a CVSS score of 9.8.
How does CVE-2019-11072 affect lighttpd?
CVE-2019-11072 affects lighttpd versions up to and including 1.4.53.
How can CVE-2019-11072 be exploited?
CVE-2019-11072 can be exploited by sending a malicious HTTP GET request to the affected server.
Is there a fix available for CVE-2019-11072?
Yes, a fix is available for CVE-2019-11072 in version 1.4.54 of lighttpd.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/lighttpd
- canonical/lighttpd lighttpd
- version/lighttpd lighttpd/1.4.53