Description

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Remediation

References

CVE-2013-6438

Related Vulnerabilities

WordPress Plugin BuddyPress Members Only Cross-Site Scripting (1.8.3)

WordPress Plugin Spiffy XSPF Player SQL Injection (0.1)

Oracle Database Server CVE-2006-0282 Vulnerability (CVE-2006-0282)

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2000-0649)

WordPress Plugin Catch Themes Demo Import Unspecified Vulnerability (1.8)

Severity

Medium

Classification

CVE-2013-6438

Tags

Missing Update Known Vulnerabilities