httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject cvs commit: httpd-dist Announcement2.html
Date Wed, 15 Sep 2004 13:25:04 GMT
jorton      2004/09/15 06:25:04

  Modified:    .        Announcement2.html
  Convert to HTML.
  Revision  Changes    Path
  1.48      +38 -24    httpd-dist/Announcement2.html
  Index: Announcement2.html
  RCS file: /home/cvs/httpd-dist/Announcement2.html,v
  retrieving revision 1.47
  retrieving revision 1.48
  diff -d -w -u -r1.47 -r1.48
  --- Announcement2.html	1 Jul 2004 16:55:41 -0000	1.47
  +++ Announcement2.html	15 Sep 2004 13:25:03 -0000	1.48
  @@ -14,44 +14,58 @@
   <img src="../../images/apache_sub.gif" alt="">
  -<h1>Apache HTTP Server 2.0.50 Released</h1>
  +<h1>Apache HTTP Server 2.0.51 Released</h1>
   <p>The Apache Software Foundation and the  The Apache HTTP Server Project are
  -   pleased to announce the release of version 2.0.50 of the Apache HTTP
  +   pleased to announce the release of version 2.0.51 of the Apache HTTP
      Server ("Apache").  This Announcement notes the significant changes
  -   in 2.0.50 as compared to 2.0.49. The Announcement is also available in
  -   German and Japanese from:</p>
  +   in 2.0.51 as compared to 2.0.50.</p>
  -  <dd><a href=""
  -    ></a></dd>
  -  <dd><a href=""
  -    ></a></dd>
  +<p>This version of Apache is principally a bug fix release.  Of
  +   particular note is that 2.0.51 addresses five security
  +   vulnerabilities:</p>
  -<p>This version of Apache is principally a bug fix release.  A summary of
  -   the bug fixes is given at the end of this document.  Of particular
  -   note is that 2.0.50 addresses two security vulnerabilities:</p>
  +<p>An input validation issue in IPv6 literal address parsing which
  +   can result in a negative length parameter being passed to memcpy.<br>
  +   <code>[<a
  +   href=""
  +   >CAN-2004-0786</a>]</code></p>
  -<p>A remotely triggered memory leak in http header parsing can allow a
  -   denial of service attack due to excessive memory consumption.<br>
  +<p>A buffer overflow in configuration file parsing could allow a
  +   local user to gain the privileges of a httpd child if the server
  +   can be forced to parse a carefully crafted .htaccess file.<br>
  -   href=""
  -   >CAN-2004-0493</a>]</code></p>
  +   href=""
  +   >CAN-2004-0747</a>]</code></p>
  +<p>A segfault in mod_ssl which can be triggered by a malicious
  +   remote server, if proxying to SSL servers has been configured.<br>
  +   <code>[<a
  +   href=""
  +   >CAN-2004-0751</a>]</code></p>
  -<p>Fixes a mod_ssl buffer overflow in the FakeBasicAuth code for a
  -   (trusted) client certificate subject DN which exceeds 6K in length.<br>
  +<p>A potential infinite loop in mod_ssl which could be triggered 
  +   given particular timing of a connection abort.<br>
  -   href=""
  -   >CAN-2004-0488</a>]</code></p>
  +   href=""
  +   >CAN-2004-0748</a>]</code></p>
  +<p>A segfault in mod_dav_fs which can be remotely triggered by an
  +   indirect lock refresh request.<br>
  +   <code>[<a
  +   href=""
  +   >CAN-2004-0809</a>]</code></p>
  +<p>The Apache HTTP Server Project would like to thank Codenomicon for
  +   supplying copies of their "HTTP Test Tool" used to discover
  +   CAN-2004-0786, and to SITIC for reporting the discovery of
  +   CAN-2004-0747.</p>
   <p>This release is compatible with modules compiled for 2.0.42 and later
      versions.  We consider this release to be the best version of Apache
      available and encourage users of all prior versions to upgrade.</p>
  -<p>Apache 2.0.50 is available for download from</p>
  +<p>Apache 2.0.51 is available for download from</p>
     <dd><a href=""></a></dd>

View raw message