Description

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

Remediation

References

CVE-2015-3183

Related Vulnerabilities

WordPress Plugin Client Invoicing by Sprout Invoices-Easy Estimates and Invoices for WordPress Security Bypass (9.3)

Django Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0473)

PHP Numeric Errors Vulnerability (CVE-2016-1904)

WordPress Plugin Swipe Checkout for WooCommerce Cross-Site Scripting (2.7.1)

Ruby Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-14064)

Severity

Medium

Classification

CVE-2015-3183

Tags

Missing Update Known Vulnerabilities