shield Security update for lighttpd

SUSE-SLE-HA-12-SP1-2017-409

This update for lighttpd fixes the following issues: Security issues fixed: - CVE-2016-1000212: don't allow requests to set the HTTP_PROXY variable. As *CGI apps might pick it up and use it for outgoing requests (bsc#990847). - CVE-2015-3200: log injection via malformed base64 string in Authentication header (bsc#932286). Bugfixes: - added su directive to logrotate file as the directory is owned by lighttpd. (bsc#981347) - fix out of bounds read in mod_scgi (debian#857255)

• Release Date
  Mar 17 2017
• References
  Bugzilla: 932286, 981347, 990847
  CVEs: CVE-2015-3200, CVE-2016-1000212
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Enterprise Server for SAP Applications 12.1 ppc64le

• Packages
  lighttpd
  A Secure, Fast, Compliant, and Very Flexible Web Server

  1.4.35-3.1 lock rpm lock src

SUSE Linux Enterprise High Availability Extension 12.1 s390x

• Packages
  lighttpd
  A Secure, Fast, Compliant, and Very Flexible Web Server

  1.4.35-3.1 lock rpm lock src

SUSE Linux Enterprise Server for SAP Applications 12.1 x86_64

• Packages
  lighttpd
  A Secure, Fast, Compliant, and Very Flexible Web Server

  1.4.35-3.1 lock rpm lock src