Unscored severity · published May 16, 2011
CVE-2011-0419
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18,…
–
CVSS
30.4%
EPSS
No
On KEV
Description
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Exploitation
Is it being used?
Exploit prediction (EPSS)30.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Android · Google
All versions, or not specified · source: NVD
HS
HTTP Server · Apache
2.0.0 through 2.0.65; 2.2.0 through 2.2.18 · source: NVD
DL
Debian Linux · Debian
5.0; 6.0; 7.0 · source: NVD
FR
Freebsd · Freebsd
All versions, or not specified · source: NVD
LE
Linux Enterprise Server · Suse
10 · source: NVD
MO
Mac OS X · Apple
10.6.0 · source: NVD
NE
Netbsd · Netbsd
5.1 · source: NVD
OP
Openbsd · Openbsd
4.8 · source: NVD
PR
Portable Runtime · Apache
before 1.4.3 · source: NVD
SO
Solaris · Oracle
10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0419
Third Party Advisory
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/fnmatch.c#rev1.22
Patch
http://cxib.net/stuff/apache.fnmatch.phps
Third Party Advisory
http://cxib.net/stuff/apr_fnmatch.txts
Vendor Advisory
http://httpd.apache.org/security/vulnerabilities_22.html
Broken Link
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability