CVE-2013-1048
Published: 6 March 2013
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
Notes
| Author | Note |
|---|---|
| seth-arnold | not part of apache upstream; vulnerability shared with Debian |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
hardy |
Released
(2.2.8-1ubuntu0.25)
|
| lucid |
Released
(2.2.14-5ubuntu8.11)
|
|
| oneiric |
Released
(2.2.20-1ubuntu1.4)
|
|
| precise |
Released
(2.2.22-1ubuntu1.3)
|
|
| quantal |
Released
(2.2.22-6ubuntu2.2)
|
|
| upstream |
Released
(2.2.22-13)
|
|
|
Patches: vendor: http://www.debian.org/security/2013/dsa-2637 |
||