thttpd vulnerabilities and fixes

Recent CVEs affecting thttpd, with upgrade or downgrade steps. 18 tracked.

thttpd has 18 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 6. Most recent: 2019-12-27. Highest priority: CVE-2003-0899 (score 69/100).

• CVE-2000-0900 HIGH 7.5 DOWNGRADE Directory traversal vulnerability in ssi CGI program in thttpd 2.19 and earlier allows remote attackers to rea
• CVE-2017-17663 CRITICAL 9.8 UPGRADE UPGRADE The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer over
• CVE-2013-0348 LOW 2.1 UPGRADE MITIGATE thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log,
• CVE-2012-5640 MEDIUM 5.5 MITIGATE thttpd has a local DoS vulnerability via specially-crafted .htpasswd files
• CVE-2009-4491 CRITICAL 9.8 DOWNGRADE thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote
• CVE-2007-0664 MEDIUM 5.0 UPGRADE thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory (/) by the Gentoo baselayout
• CVE-2007-0158 CRITICAL 9.8 DOWNGRADE thttpd 2007 has buffer underflow.
• CVE-2006-4248 HIGH 7.2 DOWNGRADE thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary
• CVE-2006-1079 HIGH 7.2 DOWNGRADE htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to
• CVE-2006-1078 HIGH 8.4 DOWNGRADE Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apach
• CVE-2005-3124 LOW 2.1 DOWNGRADE syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a
• CVE-2004-2628 MEDIUM 5.0 DOWNGRADE Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote at
• CVE-2003-0899 CRITICAL 9.8 UPGRADE Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary
• CVE-2002-1562 MEDIUM 5.0 MITIGATE Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbit
• CVE-2002-0733 HIGH 7.5 DOWNGRADE Cross-site scripting vulnerability in thttpd 2.20 and earlier allows remote attackers to execute arbitrary scr
• CVE-2001-1496 CRITICAL 9.8 UPGRADE Off-by-one buffer overflow in Basic Authentication in Acme Labs thttpd 1.95 through 2.20 allows remote attacke
• CVE-2001-0892 MEDIUM 5.0 UPGRADE Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sens
• CVE-2000-0359 HIGH 10.0 DOWNGRADE Buffer overflow in Trivial HTTP (THTTPd) allows remote attackers to cause a denial of service or execute arbit

FAQ

How do I fix thttpd vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is thttpd being exploited right now?

None of the tracked thttpd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which thttpd CVE should I patch first?

CVE-2003-0899 currently ranks highest (69/100): Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary.

RSS feed for thttpd · ← Back to latest CVEs