| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <alpine.LNX.2.02.1504211820110.28040@connie.slackware.com>
Date: Tue, 21 Apr 2015 18:20:26 -0700 (PDT)
From: Slackware Security Team <security@...ckware.com>
To: slackware-security@...ckware.com
Subject: [slackware-security] httpd (SSA:2015-111-03)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] httpd (SSA:2015-111-03)
New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/httpd-2.4.12-i486-1_slack14.1.txz: Upgraded.
This update fixes the following security issues:
* CVE-2014-3583 mod_proxy_fcgi: Fix a potential crash due to buffer
over-read, with response headers' size above 8K.
* CVE-2014-3581 mod_cache: Avoid a crash when Content-Type has an
empty value. PR 56924.
* CVE-2014-8109 mod_lua: Fix handling of the Require line when a
LuaAuthzProvider is used in multiple Require directives with
different arguments. PR57204.
* CVE-2013-5704 core: HTTP trailers could be used to replace HTTP
headers late during request processing, potentially undoing or
otherwise confusing modules that examined or modified request
headers earlier. Adds "MergeTrailers" directive to restore legacy
behavior.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3583
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3581
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8109
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.29-i486-1_slack13.0.txz
Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.29-x86_64-1_slack13.0.txz
Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.29-i486-1_slack13.1.txz
Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.29-x86_64-1_slack13.1.txz
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.29-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.29-x86_64-1_slack13.37.txz
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.12-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.12-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.12-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.12-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.12-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 13.0 package:
511973e7033d924fe8f2dfac870cfc9d httpd-2.2.29-i486-1_slack13.0.txz
Slackware x86_64 13.0 package:
5fb45ffc524b4afc2b6e3c322bd43ff2 httpd-2.2.29-x86_64-1_slack13.0.txz
Slackware 13.1 package:
47ef44a58d821fe2462817bd308e4c88 httpd-2.2.29-i486-1_slack13.1.txz
Slackware x86_64 13.1 package:
4e99389080c31b12a863d315f17e0897 httpd-2.2.29-x86_64-1_slack13.1.txz
Slackware 13.37 package:
9ecaeefcc21871e101c4e41487879ba7 httpd-2.2.29-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
4c4badc191f0c2337d0f05fe4f5f6701 httpd-2.2.29-x86_64-1_slack13.37.txz
Slackware 14.0 package:
44ee311cec11c0b8b5361871f076060a httpd-2.4.12-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
d222d77977fea4f3d2583398070e70fe httpd-2.4.12-x86_64-1_slack14.0.txz
Slackware 14.1 package:
d65e3a24abd582fb54b6da0ba926106e httpd-2.4.12-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
e655bdd8f6f7e13da6ae2c70f9c9eea0 httpd-2.4.12-x86_64-1_slack14.1.txz
Slackware -current package:
bfd8439df17a91bf8b3351a9fdafbfc9 n/httpd-2.4.12-i486-1.txz
Slackware x86_64 -current package:
3c68dceffdf6de2c67ac2b40fc3846dc n/httpd-2.4.12-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg httpd-2.4.12-i486-1_slack14.1.txz
Then, restart Apache httpd:
# /etc/rc.d/rc.httpd stop
# /etc/rc.d/rc.httpd start
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@...ckware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@...ckware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlU2zZYACgkQakRjwEAQIjN+CwCeOR3KbwIrWH4zXhOaY0AP2MRE
onYAni5MrGCwLn9VQW9vJx5kjKbLUl2+
=WJhl
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists