CVE-2013-2765

MEDIUM 5.0CVE-2013-2765 · Published 15/07/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
modsecurity trustwave	`< 2.7.4`	`2.7.4`

Description

The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.

References

archives.neohapsis.com/archives/bugtraq/2013-05/0125.html · Broken Link
lists.opensuse.org/opensuse-updates/2013-08/msg00020.html · Mailing List
lists.opensuse.org/opensuse-updates/2013-08/msg00025.html · Mailing List
lists.opensuse.org/opensuse-updates/2013-08/msg00031.html · Mailing List
sourceforge.net/mailarchive/message.php · Third Party Advisory
modsecurity.org · Vendor Advisory
shookalabs.com · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
SpiderLabs/ModSecurity commit 0840b13 · Patch
shookalabs/exploits · Exploit
raw.github.com/SpiderLabs/ModSecurity/master/CHANGES · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free