CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free)

[Stefan Bühler <stbuehler () lighttpd net>]

Hi,

I'd like to request CVE ids for the following issues in lighttpd:

1. setuid/setgid/setgroups return values are not checked

If setuid() fails for any reason (RLIMIT_NPROC) lighttpd runs as root.

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt


2. If FAMMonitorDirectory fails, lighttpd reads a value from already
free()d memory.

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt


Both issues were found with clang static analyzer, so I assume the bad
guys already know these.

regards,
Stefan

Attachment: signature.asc
Description: