Mandriva Linux Security Advisory 2014-137 - Multiple vulnerabilities have been discovered and corrected in apache-mod_wsgi. It was found that mod_wsgi did not properly drop privileges if the call to setuid failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. It was discovered that mod_wsgi could leak memory of a hosted web application via the Content-Type header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory. The updated packages have been patched to correct these issues.
3ddfcc4920c88bed0f479472956bfb387b06ff904fa88974b7ac9b7edb4d0c30
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed