|
|
|
|
|
|
|
|
|
[COPY] --- SDE-COPYRIGHT-NOTE-BEGIN ---
|
|
|
|
|
[COPY] This copyright note is auto-generated by ./scripts/Create-CopyPatch.
|
|
|
|
|
[COPY]
|
|
|
|
|
[COPY] Filename: package/.../apache/apache.desc
|
Updated apache (2.2.4 -> 2.2.8) : SECURITY - HIGH
CVE-2006-5752 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP
Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows
remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets
with browsers that perform "charset detection" when the content-type is not specified.
CVE-2007-1862 (Medium) :
The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels
of header data, which can cause Apache to return HTTP headers containing previously used data,
which could be used by remote attackers to obtain potentially sensitive information.
CVE-2007-1863 (Medium) :
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled
and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a
denial of service (child processing handler crash) via a request with the (1) s-maxage, (2)
max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
CVE-2007-3304 (Medium) :
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a
denial of service by modifying the worker_score and process_score arrays to reference an
arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1
killer."
CVE-2007-3847 (Medium) :
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a
threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy
process crash) via crafted date headers that trigger a buffer over-read.
CVE-2007-5000 (Medium) :
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server
1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
unspecified vectors.
CVE-2007-6388 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through
2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled,
allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-6421 (Low) :
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
CVE-2007-6422 (Medium) :
The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through
2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to
cause a denial of service (child process crash) via an invalid bb variable.
CVE-2008-0005 (Medium) :
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before
1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site
scripting (XSS) attacks using UTF-7 encoding.
17 years ago
|
|
|
[COPY] Copyright (C) 2006 - 2008 The OpenSDE Project
|
|
|
|
|
[COPY] Copyright (C) 2004 - 2006 The T2 SDE Project
|
|
|
|
|
[COPY] Copyright (C) 1998 - 2004 Clifford Wolf
|
|
|
|
|
[COPY]
|
|
|
|
|
[COPY] More information can be found in the files COPYING and README.
|
|
|
|
|
[COPY]
|
|
|
|
|
[COPY] This program is free software; you can redistribute it and/or modify
|
|
|
|
|
[COPY] it under the terms of the GNU General Public License as published by
|
|
|
|
|
[COPY] the Free Software Foundation; version 2 of the License. A copy of the
|
|
|
|
|
[COPY] GNU General Public License can be found in the file COPYING.
|
|
|
|
|
[COPY] --- SDE-COPYRIGHT-NOTE-END ---
|
|
|
|
|
|
|
|
|
|
[I] The HTTP web server
|
|
|
|
|
|
|
|
|
|
[T] Apache has been the most popular web server on the Internet since April
|
|
|
|
|
[T] of 1996. The May 2002 Netcraft Web Server Survey found that 56% of the
|
|
|
|
|
[T] web sites on the Internet are using Apache, thus making it more widely
|
|
|
|
|
[T] used than all other web servers combined.
|
|
|
|
|
[T]
|
|
|
|
|
[T] The Apache HTTP Server Project is an effort to develop and maintain an
|
|
|
|
|
[T] open-source HTTP server for various modern desktop and server operating
|
|
|
|
|
[T] systems, such as UNIX and Windows NT. The goal of this project is to
|
|
|
|
|
[T] provide a secure, efficient and extensible server which provides HTTP
|
|
|
|
|
[T] services in sync with the current HTTP standards.
|
|
|
|
|
|
|
|
|
|
[U] http://www.apache.org/
|
|
|
|
|
|
|
|
|
|
[A] Apache Software Foundation
|
|
|
|
|
[M] The OpenSDE Community <list@opensde.org>
|
|
|
|
|
|
|
|
|
|
[C] extra/server
|
|
|
|
|
[F] JAIL
|
|
|
|
|
|
|
|
|
|
[L] APL
|
|
|
|
|
[S] Stable
|
Updated apache (2.2.4 -> 2.2.8) : SECURITY - HIGH
CVE-2006-5752 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP
Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows
remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets
with browsers that perform "charset detection" when the content-type is not specified.
CVE-2007-1862 (Medium) :
The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels
of header data, which can cause Apache to return HTTP headers containing previously used data,
which could be used by remote attackers to obtain potentially sensitive information.
CVE-2007-1863 (Medium) :
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled
and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a
denial of service (child processing handler crash) via a request with the (1) s-maxage, (2)
max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
CVE-2007-3304 (Medium) :
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a
denial of service by modifying the worker_score and process_score arrays to reference an
arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1
killer."
CVE-2007-3847 (Medium) :
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a
threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy
process crash) via crafted date headers that trigger a buffer over-read.
CVE-2007-5000 (Medium) :
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server
1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
unspecified vectors.
CVE-2007-6388 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through
2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled,
allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-6421 (Low) :
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
CVE-2007-6422 (Medium) :
The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through
2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to
cause a denial of service (child process crash) via an invalid bb variable.
CVE-2008-0005 (Medium) :
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before
1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site
scripting (XSS) attacks using UTF-7 encoding.
17 years ago
|
|
|
[V] 2.2.8
|
|
|
|
|
[P] X -----5---9 150.000
|
|
|
|
|
|
Updated apache (2.2.4 -> 2.2.8) : SECURITY - HIGH
CVE-2006-5752 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP
Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows
remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets
with browsers that perform "charset detection" when the content-type is not specified.
CVE-2007-1862 (Medium) :
The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels
of header data, which can cause Apache to return HTTP headers containing previously used data,
which could be used by remote attackers to obtain potentially sensitive information.
CVE-2007-1863 (Medium) :
cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled
and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a
denial of service (child processing handler crash) via a request with the (1) s-maxage, (2)
max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
CVE-2007-3304 (Medium) :
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a
denial of service by modifying the worker_score and process_score arrays to reference an
arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1
killer."
CVE-2007-3847 (Medium) :
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a
threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy
process crash) via crafted date headers that trigger a buffer over-read.
CVE-2007-5000 (Medium) :
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server
1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
unspecified vectors.
CVE-2007-6388 (Medium) :
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through
2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled,
allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-6421 (Low) :
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache
HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via
the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
CVE-2007-6422 (Medium) :
The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through
2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to
cause a denial of service (child process crash) via an invalid bb variable.
CVE-2008-0005 (Medium) :
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before
1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site
scripting (XSS) attacks using UTF-7 encoding.
17 years ago
|
|
|
[D] 444351198 httpd-2.2.8.tar.gz http://www.apache.org/dist/httpd/
|
|
|
|
|
|
