CVE-2008-0983 — Lighttpd vulnerability

CWE-3996 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
4.6%
top 10.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LighttpdDebian Lighttpd
Timeline
PublishedFeb 26
Latest updateMay 1

Description

lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/lighttpd< lighttpd 1.4.18-2 (bookworm)
▶Debianlighttpd/lighttpd< 1.4.18-2+3
▶NVDlighttpd/lighttpd12 versions+11

Patches

Patch: secunia.com ↗Patch: trac.lighttpd.net ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fxrf-v868-58jw: lighttpd 1↗2022-05-01
▶
OSV
CVE-2008-0983: lighttpd 1↗2008-02-26
▶

📋Vendor Advisories

2
Debian
CVE-2008-0983: lighttpd - lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly cal...↗2008
▶
Red Hat
lighttpd crashes when it's low on file descriptors↗
▶

💬Community

1
Bugzilla
CVE-2008-0983 lighttpd crashes when it's low on file descriptors↗2008-02-22
▶