Lucian Nitescu

NULL pointer dereference vulnerability in Apache HTTP Server's mod md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

An out-of-bounds write issue exists in the `mod proxy html` module when processing specially crafted HTTP response bodies. An out-of-bounds write occurs when a program writes data past the end of the intended buffer, which can lead to memory corruption.

A Use After Free issue exists in the `mod http2` module of the Apache HTTP Server. This occurs via shared session `bbtmp` re-entrancy, which can lead to memory corruption when the system attempts to access memory that has already been freed.

A NULL pointer dereference occurs in the `mod xml2enc` module. This allows an untrusted backend server to trigger a denial of service by sending a proxied response with a charset that partially succeeds and then fails during conversion.

Improper Privilege Management allows local .htaccess authors to read files using the privileges of the httpd user.

The issue allows Directory Traversal, which can lead to partial access to data.