FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-2687

This CVE name corresponds to:

Entered	Topic
2012-11-02	apache22 -- several vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-2687 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-2687
Phase	Assigned(20120514)

Description

Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

References

Source	Reference
MLIST	[announce] 20120821 [ANNOUNCEMENT] Apache HTTP Server 2.4.3 Released
CONFIRM	http://httpd.apache.org/security/vulnerabilities_24.html
CONFIRM	http://www.apache.org/dist/httpd/CHANGES_2.4.3
CONFIRM	http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
CONFIRM	http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
CONFIRM	http://support.apple.com/kb/HT5880
AIXAPAR	SE53614
APPLE	APPLE-SA-2013-09-12-1
REDHAT	RHSA-2012:1591
REDHAT	RHSA-2012:1592
REDHAT	RHSA-2012:1594
REDHAT	RHSA-2013:0130
SUSE	openSUSE-SU-2013:0243
SUSE	openSUSE-SU-2013:0245
SUSE	openSUSE-SU-2013:0248
UBUNTU	USN-1627-1
BID	55131
OVAL	oval:org.mitre.oval:def:18832
OVAL	oval:org.mitre.oval:def:19539
SECUNIA	51607
SECUNIA	50894