CVE-2009-2699
High · 7.5CVSS
7.5
EPSS
14.2%
Published
Oct 13, 2009
CISA due date
—
The record
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Point of Sale 11 SP3 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Studio Onsite 1.3 | apache2 | 0 | 2.2.34-70.12.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.23-4.1 |
Related vulnerabilities
- CVE-2017-7679 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte… Also affects apache2
- CVE-2017-7668 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug… Also affects apache2
- CVE-2017-3169 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a… Also affects apache2
- CVE-2017-3167 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the… Also affects apache2
- CVE-2012-0021 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache… Also affects apache2
- CVE-2010-0425 modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through… Also affects apache2
- CVE-2016-2161 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can… Also affects apache2
- CVE-2016-8743 Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the… Also affects apache2