{"id":"CVE-2010-3872","state":"PUBLISHED","title":"Httpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.c","description":"A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.","publishedAt":"2010-11-20T20:00:00.000Z","updatedAt":"2024-08-07T03:26:12.242Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a mod_fcgid","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Fedora Fedora"],"affected":[{"vendor":"n/a","product":"mod_fcgid","versions":[{"version":"2.3.6","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050930.html","http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050932.html","http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050976.html","http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00005.html","http://osvdb.org/69275","http://secunia.com/advisories/42288","http://secunia.com/advisories/42302","http://secunia.com/advisories/42815","http://www.debian.org/security/2010/dsa-2140","http://www.gossamer-threads.com/lists/apache/announce/391406","http://www.securityfocus.com/bid/44900","http://www.vupen.com/english/advisories/2010/2997","http://www.vupen.com/english/advisories/2010/2998","http://www.vupen.com/english/advisories/2011/0031","https://access.redhat.com/security/cve/CVE-2010-3872","https://bugzilla.redhat.com/show_bug.cgi?id=2248172","https://exchange.xforce.ibmcloud.com/vulnerabilities/63303","https://github.com/apache/httpd-mod_fcgid/commit/b1afa70840b4ab4e6fbc12ac8798b2f3ccc336b2","https://issues.apache.org/bugzilla/show_bug.cgi?id=49406"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T19:39:43.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2010/3xxx/CVE-2010-3872.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2010-3872","state":"PUBLISHED","datePublished":"2010-11-20T20:00:00.000Z","dateUpdated":"2024-08-07T03:26:12.242Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2010-10-08T00:00:00.000Z"},"containers":{"cna":{"title":"Httpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.c","descriptions":[{"lang":"en","value":"A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash."}],"affected":[{"vendor":"n/a","product":"mod_fcgid","versions":[{"version":"2.3.6","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Fedora","product":"Fedora","packageName":"mod_fcgid","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050930.html","name":"FEDORA-2010-17474","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050932.html","name":"FEDORA-2010-17434","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050976.html","name":"FEDORA-2010-17472","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00004.html","name":"openSUSE-SU-2011:0884","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00005.html","name":"SUSE-SU-2011:0885","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://osvdb.org/69275","name":"69275","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://secunia.com/advisories/42288","name":"42288","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/42302","name":"42302","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/42815","name":"42815","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2010/dsa-2140","name":"DSA-2140","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.gossamer-threads.com/lists/apache/announce/391406","name":"[apache] 20101107 [ANNOUNCE] mod_fcgid 2.3.6 is released","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/44900","name":"44900","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2010/2997","name":"ADV-2010-2997","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2010/2998","name":"ADV-2010-2998","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2011/0031","name":"ADV-2011-0031","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3872","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248172","name":"RHBZ#2248172","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/63303","name":"apache-fcgid-bo(63303)","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://github.com/apache/httpd-mod_fcgid/commit/b1afa70840b4ab4e6fbc12ac8798b2f3ccc336b2"},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=49406","tags":["x_refsource_CONFIRM"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","description":"Stack-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-01-25T05:17:45.315Z"},"datePublic":"2010-06-08T00:00:00.000Z","x_redhatCweChain":"CWE-121: Stack-based Buffer Overflow","timeline":[{"lang":"en","time":"2023-10-17T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2010-06-08T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050930.html","name":"FEDORA-2010-17474","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050932.html","name":"FEDORA-2010-17434","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050976.html","name":"FEDORA-2010-17472","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00004.html","name":"openSUSE-SU-2011:0884","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00005.html","name":"SUSE-SU-2011:0885","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://osvdb.org/69275","name":"69275","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/42288","name":"42288","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/42302","name":"42302","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/42815","name":"42815","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.debian.org/security/2010/dsa-2140","name":"DSA-2140","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.gossamer-threads.com/lists/apache/announce/391406","name":"[apache] 20101107 [ANNOUNCE] mod_fcgid 2.3.6 is released","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/44900","name":"44900","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2010/2997","name":"ADV-2010-2997","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2010/2998","name":"ADV-2010-2998","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2011/0031","name":"ADV-2011-0031","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3872","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248172","name":"RHBZ#2248172","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/63303","name":"apache-fcgid-bo(63303)","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://github.com/apache/httpd-mod_fcgid/commit/b1afa70840b4ab4e6fbc12ac8798b2f3ccc336b2","tags":["x_transferred"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=49406","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-07T03:26:12.242Z"}}]}}}