CVE-2007-5824
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to...
CVE-2007-5824 is a high vulnerability (CVSS 7.1) in Firefly Media Server, published November 5, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.59%, the 92nd percentile. Fixed in mt-daapd 0.2.4+r1376-1.1+etch1.
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
Exploit likelihood
What each source reports
NVD Score used
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
- Record
CVE-2007-5824- CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
- Record
CVE-2007-5824- Updated
- 2026-11-02
EUVDEUVD-2007-5794 No score
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
- Record
EUVD-2007-5794- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-33cc-8pcc-ph75 No score
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to...
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
- Record
GHSA-33cc-8pcc-ph75- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mt-daapdDebian:4.0 |
before 0.2.4+r1376-1.1+etch1, plus listed versions 0.2.4+r1376-1 |
0.2.4+r1376-1.1+etch1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Firefly Media Server 0.2.4 - Remote Denial of Service | 2007-11-02 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
exchange.xforce.ibmcloud.com/vulnerabilities/38242
debian.org/security/2008/dsa-1597
securityfocus.com/archive/1/483211/100/0/threaded
Show 9 moreShow less
secunia.com/advisories/28269
exploit-db.com/exploits/4600
sourceforge.net/project/shownotes.php?group_id=98211&release_id=548679
bugs.gentoo.org/show_bug.cgi?id=200110
gentoo.org/security/en/glsa/glsa-200712-18.xml
nvd.nist.gov/vuln/detail/CVE-2007-5824
github.com/advisories/GHSA-33cc-8pcc-ph75