CVE-2016-4975

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4975
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4975.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-4975
Downstream
Related
Published
2018-08-14T12:29:00.220Z
Modified
2026-04-11T16:50:41.192872Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cd3e5a83cd5765d12b3237631c829eaff80f8425
Last affected
1c7da70e72d96fa72244bd032d89769c1399b5f7
Last affected
43559342e30402bbca6ca84ab88a533f118bf444
Last affected
8dfd45d1f67969afa0b95faf03a9fc283e0c5b63
Last affected
9e1e5d76b296e7e00ba8f56c6976cf8bd69a0e4e
Last affected
8fa038317b96b70e04656aadb2ab20e3212a6e87
Last affected
0cddd3aa8709b50b3c1d52b478defeb91f230ce1
Last affected
32d03a287f8f33adcc7af96844089cff5ce2ca09
Last affected
34ea1cee78449ff1081267cd2348a01099b04ac9
Last affected
810842a1dc70b67ac82fd53e09250b8bb7dbe27d
Last affected
777e5a254758046a13ebeaf09fa4af6467bf8910
Last affected
926546a5bb798796aec1135994c6c242529e1d94
Last affected
cad4926fd376fd483859ab4b1871b3e9473cae01
Last affected
f54aa3b08da564fb8e1664f770ce2c083b8a0c69
Last affected
87777f4289970214d3fcf2885dbf01188371b738
Last affected
ea2107f62fec7368c0d07294626d92921cffa794
Last affected
f6204293872d3345bea724149b9d9cc3878e61be
Last affected
79399902e001e6edac9a0314f2e2e6dc580640a0
Last affected
3614ebd12db5e555ac7f2975afa530116d204335
Last affected
a5fd1e3e9921e87e9c5526198e8bdc8db6b75061
Last affected
647bc6a13a11ae7772391170fd176ad8b8846b87
Last affected
803b3cbae02b4f7562bbcdf5f9d7fd82f4cf48cf
Last affected
886787685c97f9c392adca5ac29d3e8bd3aef7c5
Last affected
82b0da5c50d9e1c226b1eaa2e7780921be1386b3
Last affected
7b5870f6ce45d2a1baef173e8a634e6044434943
Last affected
cef6805cb18886c5454a38f3501c5e3c990c0b3d
Last affected
79f35160c372de1e867542e1705962fb0880a647
Last affected
60fa04727910859b5512f7bbb36c53c4652cff2c
Last affected
67578c0315accbca1bba22d695c59d51197c99cc
Last affected
14434f9be6e1624a4b3070b0df00901fb62e9ca4
Last affected
408b0bd76056d59fa1d46deab60904b816f0d119
Last affected
7650f0ca88028593a7c5fbba2e20bca4a65b031d
Last affected
f2b561181dbd0c689fd583c60878ce05854ec5f9
Last affected
7ea253ccfeaec99b5684c909dce6d9a6d7ee6486
Last affected
015ab81d44c1f6def12fdbb7dc8d8241bf8e3ef5
Last affected
1287b680fbde78d9289029b6a6b63a3f9e58d704
Last affected
2d1deb10cfafe25ade7f30307e13b6d0c21a5473
Last affected
47a9d8e8abf5697b4580c3ee2ade302b5c058fa6
Last affected
b7ef32c4957883ab17105fa82e6331bf48bed78a
Last affected
6e65a7f3dadcade4274ae53f734d4c35188e3786
Last affected
ef07cb031c6f8f7ac483c26fc858aad68c365fd9
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.24:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.25:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.26:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.27:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.29:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.31:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*"
    ],
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.2.0"
        },
        {
            "last_affected": "2.2.2"
        },
        {
            "last_affected": "2.2.3"
        },
        {
            "last_affected": "2.2.4"
        },
        {
            "last_affected": "2.2.6"
        },
        {
            "last_affected": "2.2.8"
        },
        {
            "last_affected": "2.2.9"
        },
        {
            "last_affected": "2.2.10"
        },
        {
            "last_affected": "2.2.11"
        },
        {
            "last_affected": "2.2.12"
        },
        {
            "last_affected": "2.2.13"
        },
        {
            "last_affected": "2.2.14"
        },
        {
            "last_affected": "2.2.15"
        },
        {
            "last_affected": "2.2.16"
        },
        {
            "last_affected": "2.2.17"
        },
        {
            "last_affected": "2.2.18"
        },
        {
            "last_affected": "2.2.19"
        },
        {
            "last_affected": "2.2.20"
        },
        {
            "last_affected": "2.2.21"
        },
        {
            "last_affected": "2.2.22"
        },
        {
            "last_affected": "2.2.23"
        },
        {
            "last_affected": "2.2.24"
        },
        {
            "last_affected": "2.2.25"
        },
        {
            "last_affected": "2.2.26"
        },
        {
            "last_affected": "2.2.27"
        },
        {
            "last_affected": "2.2.29"
        },
        {
            "last_affected": "2.2.31"
        },
        {
            "last_affected": "2.4.1"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "last_affected": "2.4.3"
        },
        {
            "last_affected": "2.4.4"
        },
        {
            "last_affected": "2.4.6"
        },
        {
            "last_affected": "2.4.7"
        },
        {
            "last_affected": "2.4.9"
        },
        {
            "last_affected": "2.4.10"
        },
        {
            "last_affected": "2.4.12"
        },
        {
            "last_affected": "2.4.16"
        },
        {
            "last_affected": "2.4.17"
        },
        {
            "last_affected": "2.4.18"
        },
        {
            "last_affected": "2.4.20"
        },
        {
            "last_affected": "2.4.23"
        }
    ]
}

Affected versions

2.*
2.1.10
2.2.0
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.26
2.2.27
2.2.29
2.2.3
2.2.31
2.2.4
2.2.6
2.2.8
2.2.9
2.4.1
2.4.10
2.4.12
2.4.16
2.4.17
2.4.18
2.4.2
2.4.20
2.4.23
2.4.3
2.4.4
2.4.6
2.4.7
2.4.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4975.json"