Debian/lighttpd: unknown

mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.

Action: Upgrade lighttpd to 1.4.18-4 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2008-1111#Debian:13/lighttpd
• https://security-tracker.debian.org/tracker/CVE-2008-1111

published 2008-03-04T23:44:00Z · modified 2026-10-23T17:47:44.299059672Z · JSON