Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: error (nike.apache.org: local policy)
Date: Wed, 26 Jun 2013 15:10:48 -0500
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
To: dev@httpd.apache.org
Cc: trawick@gmail.com
Subject: Re: Tagging 2.0.65...
Message-ID: <20130626151048.01ae604c@hub>
In-Reply-To: 
 <CAKUrXK5iTZ8H78AbG+Bu1Lxs5gNCyQNPqNARFpQjNOT1n6quhA@mail.gmail.com>
References: <20130626104205.038f4394@hub>
	<CAKUrXK5iTZ8H78AbG+Bu1Lxs5gNCyQNPqNARFpQjNOT1n6quhA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 26 Jun 2013 13:30:25 -0400
Jeff Trawick <trawick@gmail.com> wrote:
> 
> Did anyone else have a chance to think about wrowe's suggested
> addendum to the CHANGES entry for CVE-2011-3607?

I've tweaked this slightly, please holler if anyone has some better
wording to offer;

Changes with Apache 2.0.65

  *) SECURITY: CVE-2011-3607 (cve.mitre.org)
     Fix integer overflow in ap_pregsub() which, when the mod_setenvif
     module is enabled, could allow local users to gain privileges via
     a .htaccess file. [Stefan Fritsch, Greg Ames]

       NOTE: it remains possible to exhaust all memory using a carefully
       crafted .htaccess rule, which will not be addressed in 2.0;
       enabling processing of .htaccess files authored by untrusted
       users is the root of such security risks.  Upgrade to httpd
       2.2.25 or later to limit this specific risk.