Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 28 May 2013 06:14:32 -0400 (EDT)
From: Jan Lieskovsky <>
Cc: "Steven M. Christey" <>,
        Athmane Madjoudj <>
Subject: [Notification] CVE-2013-2765 mod_security: NULL pointer dereference
 (DoS, crash) when forceRequestBodyVariable action triggered and unknown
 Content-Type was used

Hello Steve, vendors,

  as brought to me by Athmane, ModSecurity upstream has release v2.7.4 version:

correcting one security NULL pointer dereference flaw (CVE-2013-2765) - from [2]:

* Fixed Remote Null Pointer DeReference (CVE-2013-2765). When forceRequestBodyVariable
  action is triggered and a unknown Content-Type is used, mod_security will crash
  trying to manipulate msr->msc_reqbody_chunks->elts however msr->msc_reqbody_chunks
  is NULL. (Thanks Younes JAAIDI).


Relevant upstream patch (seems to be the following):

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Thanks goes to Athmane for bringing this to our attention.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.