CVE-2018-25103

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
lighttpd	lighttpd	<= 1.4.50
lighttpd	lighttpd	<= 1.4.50

References

Timeline

Published: Jun 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2018

CVE-2018-251044.3A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the func CVE-2018-251059.8The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in CVE-2018-251066.3A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects CVE-2018-251077.5The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of rando CVE-2018-251087.5An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.CVE-2018-251096.4A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified a CVE-2018-251107.5Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in se CVE-2018-251114.4django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.CVE-2018-251127.5An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creatin CVE-2018-251138.7An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability all CVE-2018-251149.3A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and mis CVE-2018-251159.8Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, conta