CVE-2010-0425
NoneCVSS
—
EPSS
94.2%
Published
Mar 5, 2010
CISA due date
—
The record
modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Point of Sale 11 SP3 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | apache2 | 0 | 2.2.34-70.12.1 |
| SUSE:Studio Onsite 1.3 | apache2 | 0 | 2.2.34-70.12.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.23-4.1 |
Related vulnerabilities
- CVE-2017-7679 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte… Also affects apache2
- CVE-2017-7668 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug… Also affects apache2
- CVE-2017-3169 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a… Also affects apache2
- CVE-2017-3167 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the… Also affects apache2
- CVE-2012-0021 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache… Also affects apache2
- CVE-2009-2699 The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache… Also affects apache2
- CVE-2016-2161 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can… Also affects apache2
- CVE-2016-8743 Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the… Also affects apache2