PatchTheCVEwebdav vulnerabilities
Recent CVEs affecting webdav products. 5 tracked.
webdav has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2009-08-21. Highest priority: CVE-2004-0179 (score 58/100).
- CVE-2009-2474 MEDIUM 5.8 UPGRADE UPGRADE neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name
- CVE-2009-2473 MEDIUM 4.3 DOWNGRADE neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allo
- CVE-2008-3746 MEDIUM 4.3 DOWNGRADE neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and cr
- CVE-2004-0398 HIGH 7.5 UPGRADE UPGRADE Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5
- CVE-2004-0179 MEDIUM 6.8 UPGRADE MITIGATE Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon includ
FAQ
How do I fix webdav vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is webdav being exploited right now?
None of the tracked webdav CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which webdav CVE should I patch first?
CVE-2004-0179 currently ranks highest (58/100): Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon includ.