Civetweb
Monthly
Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.
Local privilege escalation in CivetWeb v1.16 service allows authenticated users to execute arbitrary code with SYSTEM privileges via unquoted service path exploitation. The Windows service configuration lacks quotes around 'C:\Program Files\CivetWeb\CivetWeb.exe', enabling attackers to place malicious executables in directories scanned before the intended path (e.g., 'C:\Program.exe' or 'C:\Program Files\CivetWeb.exe'). No public exploit identified at time of analysis, though EPSS data not available. Patch available per vendor advisory from INCIBE.
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.
Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.
Local privilege escalation in CivetWeb v1.16 service allows authenticated users to execute arbitrary code with SYSTEM privileges via unquoted service path exploitation. The Windows service configuration lacks quotes around 'C:\Program Files\CivetWeb\CivetWeb.exe', enabling attackers to place malicious executables in directories scanned before the intended path (e.g., 'C:\Program.exe' or 'C:\Program Files\CivetWeb.exe'). No public exploit identified at time of analysis, though EPSS data not available. Patch available per vendor advisory from INCIBE.
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.