Secunia

Two vulnerabilities have been reported in ModSecurity, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An error in the PDF XSS protection implementation can be exploited to cause a crash via a specially crafted HTTP request.

Successful exploitation requires that PDF XSS protection is enabled (disabled by default).

2) An NULL pointer dereference error when parsing multipart requests can be exploited to cause a crash via multipart content with a missing part header name.

Solution
Update to version 2.5.9.

Provided and/or discovered by
The vendor credits:
1) Steve Grubb, Red Hat
2) Juan Galiana Lara, Internet Security Auditors

Changelog
Further details available in Customer Area

Original Advisory
http://www.modsecurity.org/
http://sourceforge.net/project/shownotes.php?release_id=667538
http://sourceforge.net/project/shownotes.php?release_id=667542

Internet Security Auditors:
http://lists.grok.org.uk/pipermail/full-disclosure/2009-March/068467.html

Deep Links
Links available in Customer Area