[ubuntu/jaunty-security] apache2 2.2.11-2ubuntu2.5 (Accepted)
Ubuntu Installer
archive at ubuntu.com
Thu Nov 19 00:04:48 GMT 2009
apache2 (2.2.11-2ubuntu2.5) jaunty-security; urgency=low
* SECURITY UPDATE: Reject client-initiated SSL/TLS renegotiations.
Partial fix for CVE-2009-3555. Configurations requiring renegotiation
of per-directory/location access controls are still affected until
OpenSSL is updated.
- debian/patches/904_CVE-2009-3555.dpatch: disable all client
renegotiations
- CVE-2009-3555
* SECURITY UPDATE: fix NULL pointer dereference in mod_proxy_ftp module
- debian/patches/905-CVE-2009-3094.dpatch: fix NULL pointer dereference
in mod_proxy_ftp.c/apr_socket_close() and potential buffer overread
in EPSV response parser
- CVE-2009-3094
* SECURITY UPDATE: fix access control bypass in mod_proxy_ftp when
configured as a reverse proxy
- debian/patches/906-CVE-2009-3095.dpatch: adjust proxy_ftp_handler()
in mod_proxy_ftp.c to fail if the decoded Basic credentials contain
special characters.
- CVE-2009-3095
Date: Thu, 12 Nov 2009 12:46:19 -0600
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/apache2/2.2.11-2ubuntu2.5
-------------- next part --------------
Format: 1.8
Date: Thu, 12 Nov 2009 12:46:19 -0600
Source: apache2
Binary: apache2.2-common apache2-mpm-worker apache2-mpm-prefork apache2-mpm-event apache2-utils apache2-suexec apache2-suexec-custom apache2 apache2-doc apache2-prefork-dev apache2-threaded-dev apache2-src apache2-dbg
Architecture: source
Version: 2.2.11-2ubuntu2.5
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description:
apache2 - Apache HTTP Server metapackage
apache2-dbg - Apache debugging symbols
apache2-doc - Apache HTTP Server documentation
apache2-mpm-event - Apache HTTP Server - event driven model
apache2-mpm-prefork - Apache HTTP Server - traditional non-threaded model
apache2-mpm-worker - Apache HTTP Server - high speed threaded model
apache2-prefork-dev - Apache development headers - non-threaded MPM
apache2-src - Apache source code
apache2-suexec - Standard suexec program for Apache 2 mod_suexec
apache2-suexec-custom - Configurable suexec program for Apache 2 mod_suexec
apache2-threaded-dev - Apache development headers - threaded MPM
apache2-utils - utility programs for webservers
apache2.2-common - Apache HTTP Server common files
Changes:
apache2 (2.2.11-2ubuntu2.5) jaunty-security; urgency=low
.
* SECURITY UPDATE: Reject client-initiated SSL/TLS renegotiations.
Partial fix for CVE-2009-3555. Configurations requiring renegotiation
of per-directory/location access controls are still affected until
OpenSSL is updated.
- debian/patches/904_CVE-2009-3555.dpatch: disable all client
renegotiations
- CVE-2009-3555
* SECURITY UPDATE: fix NULL pointer dereference in mod_proxy_ftp module
- debian/patches/905-CVE-2009-3094.dpatch: fix NULL pointer dereference
in mod_proxy_ftp.c/apr_socket_close() and potential buffer overread
in EPSV response parser
- CVE-2009-3094
* SECURITY UPDATE: fix access control bypass in mod_proxy_ftp when
configured as a reverse proxy
- debian/patches/906-CVE-2009-3095.dpatch: adjust proxy_ftp_handler()
in mod_proxy_ftp.c to fail if the decoded Basic credentials contain
special characters.
- CVE-2009-3095
Checksums-Sha1:
6afd94eeed2b035409a6e50b631d3130099e0c8d 1795 apache2_2.2.11-2ubuntu2.5.dsc
be3a301d7465a1e864b471d8a40d3c6928eac474 141023 apache2_2.2.11-2ubuntu2.5.diff.gz
Checksums-Sha256:
5a97dfe5a56bac9ff1e36902d6340643f19fc3030fc3c9ac943256ba05a8ddc9 1795 apache2_2.2.11-2ubuntu2.5.dsc
154782a1b6c5285d8ce54965204a3f7140c55a0a8cefd9dfd3b6b54577239f0c 141023 apache2_2.2.11-2ubuntu2.5.diff.gz
Files:
59720f4d7ad291c986d92ec120750c3d 1795 web optional apache2_2.2.11-2ubuntu2.5.dsc
50d6737005a6d4fe601e223a39293f99 141023 web optional apache2_2.2.11-2ubuntu2.5.diff.gz
Original-Maintainer: Debian Apache Maintainers <debian-apache at lists.debian.org>
More information about the Jaunty-changes
mailing list