httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From build...@apache.org
Subject svn commit: r832458 - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
Date Wed, 19 Sep 2012 13:34:33 GMT
Author: buildbot
Date: Wed Sep 19 13:34:33 2012
New Revision: 832458

Log:
Staging update by buildbot for httpd

Modified:
    websites/staging/httpd/trunk/content/   (props changed)
    websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
    websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
    websites/staging/httpd/trunk/content/security/vulnerabilities_24.html

Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Wed Sep 19 13:34:33 2012
@@ -1 +1 @@
-1384562
+1387590

Modified: websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml Wed Sep 19 13:34:33
2012
@@ -1,4 +1,37 @@
-<security updated="20120418">
+<security updated="20120920">
+
+<issue fixed="2.2.23-dev" reported="20120531" public="20120613">
+<cve name="CVE-2012-2687"/>
+<severity level="4">low</severity>
+<title>XSS in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible XSS for sites which use mod_negotiation and allow
+untrusted uploads to locations which have MultiViews enabled.
+</p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
 
 <issue fixed="2.4.3" reported="20120531" public="20120613" released="20120821">
 <cve name="CVE-2012-2687"/>
@@ -8,6 +41,7 @@
 Possible XSS for sites which use mod_negotiation and allow
 untrusted uploads to locations which have MultiViews enabled.
 </p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
 </description>
 <affects prod="httpd" version="2.4.2"/>
 <affects prod="httpd" version="2.4.1"/>
@@ -28,6 +62,40 @@ between users.
 <affects prod="httpd" version="2.4.1"/>
 </issue>
 
+<issue fixed="2.2.23-dev" reported="20120214" public="20120302" released="20120417">
+<cve name="CVE-2012-0883"/>
+<severity level="4">low</severity>
+<title>insecure LD_LIBRARY_PATH handling</title>
+<description><p>
+Insecure handling of LD_LIBRARY_PATH was found that could
+lead to the current working directory to be searched for DSOs.
+This could allow a local user to execute code as root if an
+administrator runs apachectl from an untrusted directory.
+</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
 <issue fixed="2.4.2" reported="20120214" public="20120302" released="20120417">
 <cve name="CVE-2012-0883"/>
 <severity level="4">low</severity>
@@ -1248,6 +1316,27 @@ processed by the pattern preparation eng
 <affects prod="httpd" version="2.2.0"/>
 </issue>
 
+<issue fixed="2.2.12" reported="20080115" public="20080121" released="20090727">
+<cve name="CVE-2008-0456"/>
+<severity level="4">low</severity>
+<title>CRLF injection in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible CRLF injection allowing HTTP response splitting attacks for sites
+which use mod_negotiation and allow untrusted uploads to locations which have
+MultiViews enabled. 
+</p></description>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
 <issue fixed="2.2.10" public="20080805" reported="20080728" released="20081031">
 <cve name="CVE-2008-2939"/>
 <severity level="4">low</severity>

Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_22.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_22.html Wed Sep 19 13:34:33
2012
@@ -83,7 +83,49 @@ in a "-dev" release then this means that
 the development source tree and will be part of an upcoming full release.</p><p>
This page is created from a database of vulnerabilities originally
 populated by Apache Week.  Please send comments or corrections for
 these vulnerabilities to the <a href="/security_report.html">Security
-Team</a>.  </p><h1 id="2.2.22">
+Team</a>.  </p><h1 id="2.2.23-dev">
+Fixed in Apache httpd 2.2.23-dev</h1><dl>
+  <dd>
+    <b>low: </b>
+    <b>
+      <name name="CVE-2012-2687">XSS in mod_negotiation when untrusted uploads are
supported</name>
+    </b>
+    <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2687">CVE-2012-2687</a>
+    <p>
+Possible XSS for sites which use mod_negotiation and allow
+untrusted uploads to locations which have MultiViews enabled.
+</p>
+    <p>Note: This issue is also known as CVE-2008-0455.</p>
+  </dd>
+  <dd>
+  Reported to security team: 31st May 2012<br/>
+  Issue public: 13th June 2012<br/></dd>
+  <dd/>
+  <dd>
+      Affects: 
+    2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12,
2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+  <dd>
+    <b>low: </b>
+    <b>
+      <name name="CVE-2012-0883">insecure LD_LIBRARY_PATH handling</name>
+    </b>
+    <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883">CVE-2012-0883</a>
+    <p>
+Insecure handling of LD_LIBRARY_PATH was found that could
+lead to the current working directory to be searched for DSOs.
+This could allow a local user to execute code as root if an
+administrator runs apachectl from an untrusted directory.
+</p>
+  </dd>
+  <dd>
+  Reported to security team: 14th February 2012<br/>
+  Issue public: 2nd March 2012<br/></dd>
+  <dd>
+  Update Released: 17th April 2012<br/></dd>
+  <dd>
+      Affects: 
+    2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12,
2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+</dl><h1 id="2.2.22">
 Fixed in Apache httpd 2.2.22</h1><dl>
   <dd>
     <b>low: </b>
@@ -725,6 +767,26 @@ from executing commands from a Server-Si
       Affects: 
     2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
   <dd>
+    <b>low: </b>
+    <b>
+      <name name="CVE-2008-0456">CRLF injection in mod_negotiation when untrusted uploads
are supported</name>
+    </b>
+    <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0456">CVE-2008-0456</a>
+    <p>
+Possible CRLF injection allowing HTTP response splitting attacks for sites
+which use mod_negotiation and allow untrusted uploads to locations which have
+MultiViews enabled. 
+</p>
+  </dd>
+  <dd>
+  Reported to security team: 15th January 2008<br/>
+  Issue public: 21st January 2008<br/></dd>
+  <dd>
+  Update Released: 27th July 2009<br/></dd>
+  <dd>
+      Affects: 
+    2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+  <dd>
     <b>moderate: </b>
     <b>
       <name name="CVE-2009-1956">APR-util off-by-one overflow</name>

Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_24.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_24.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_24.html Wed Sep 19 13:34:33
2012
@@ -115,6 +115,7 @@ between users.
 Possible XSS for sites which use mod_negotiation and allow
 untrusted uploads to locations which have MultiViews enabled.
 </p>
+    <p>Note: This issue is also known as CVE-2008-0455.</p>
   </dd>
   <dd>
   Reported to security team: 31st May 2012<br/>



Mime
View raw message