VDB
CVE-2016-4975
CVE-2016-4975
PUBLISHED
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
EPSS 73.27% · 98.8th percentile
Risk Scores
EPSS Score
73.27%
98.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | apache2 | 2.4.7-1ubuntu1, 2.4.7-1ubuntu4.1, 2.4.7-1ubuntu4.4 |
| Ubuntu:16.04:LTS | apache2 | 2.4.12-2ubuntu2, 2.4.17-1ubuntu1, 2.4.17-2ubuntu1 |
Exploit Intelligence
- mod_userdir CRLF injection (CVE-2016-4975) (hackerone)
- mod_userdir CRLF injection (CVE-2016-4975) (hackerone)
- mod_userdir CRLF injection (CVE-2016-4975) (hackerone)
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
- https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 (circl)
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (circl)
…and 25 more exploits
Timeline
- CVE Published
- Oct 2, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Dec 17, 2024 EPSS Score
- Mar 17, 2025 EPSS Score
- Mar 23, 2025 EPSS Score
- Mar 24, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- May 1, 2025 EPSS Score
- May 4, 2025 EPSS Score
- Jun 4, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-4975 third-party-advisory
- https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 third-party-advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 third-party-advisory
- https://ubuntu.com/security/notices/USN-3279-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-4975 third-party-advisory