MGASA-2018-0430
Updated lighttpd packages fix security vulnerabilities
Updated lighttpd package fixes security vulnerabilities:
Potential path traversal with specific configs or in some use cases in mod_alias.
use-after-free invalid Range requests in core.
Process headers after combining folded headers in core.
Skip username "." and ".." in mod_userdir.
What each source reports
OSV No score
Updated lighttpd packages fix security vulnerabilities
Updated lighttpd package fixes security vulnerabilities:
Potential path traversal with specific configs or in some use cases in mod_alias.
use-after-free invalid Range requests in core.
Process headers after combining folded headers in core.
Skip username "." and ".." in mod_userdir.
- Record
MGASA-2018-0430- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdMageia:6 |
before 1.4.51-1.mga6 | 1.4.51-1.mga6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2018-0430 is a vulnerability with no CVSS score yet in lighttpd, published November 3, 2018. No source lists public exploit code. Fixed in lighttpd 1.4.51-1.mga6.