You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bu...@apache.org on 2012/09/19 15:34:33 UTC
svn commit: r832458 - in /websites/staging/httpd/trunk/content: ./
security/vulnerabilities-httpd.xml security/vulnerabilities_22.html
security/vulnerabilities_24.html
Author: buildbot
Date: Wed Sep 19 13:34:33 2012
New Revision: 832458
Log:
Staging update by buildbot for httpd
Modified:
websites/staging/httpd/trunk/content/ (props changed)
websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
websites/staging/httpd/trunk/content/security/vulnerabilities_24.html
Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Wed Sep 19 13:34:33 2012
@@ -1 +1 @@
-1384562
+1387590
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml Wed Sep 19 13:34:33 2012
@@ -1,4 +1,37 @@
-<security updated="20120418">
+<security updated="20120920">
+
+<issue fixed="2.2.23-dev" reported="20120531" public="20120613">
+<cve name="CVE-2012-2687"/>
+<severity level="4">low</severity>
+<title>XSS in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible XSS for sites which use mod_negotiation and allow
+untrusted uploads to locations which have MultiViews enabled.
+</p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
<issue fixed="2.4.3" reported="20120531" public="20120613" released="20120821">
<cve name="CVE-2012-2687"/>
@@ -8,6 +41,7 @@
Possible XSS for sites which use mod_negotiation and allow
untrusted uploads to locations which have MultiViews enabled.
</p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
</description>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
@@ -28,6 +62,40 @@ between users.
<affects prod="httpd" version="2.4.1"/>
</issue>
+<issue fixed="2.2.23-dev" reported="20120214" public="20120302" released="20120417">
+<cve name="CVE-2012-0883"/>
+<severity level="4">low</severity>
+<title>insecure LD_LIBRARY_PATH handling</title>
+<description><p>
+Insecure handling of LD_LIBRARY_PATH was found that could
+lead to the current working directory to be searched for DSOs.
+This could allow a local user to execute code as root if an
+administrator runs apachectl from an untrusted directory.
+</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
<issue fixed="2.4.2" reported="20120214" public="20120302" released="20120417">
<cve name="CVE-2012-0883"/>
<severity level="4">low</severity>
@@ -1248,6 +1316,27 @@ processed by the pattern preparation eng
<affects prod="httpd" version="2.2.0"/>
</issue>
+<issue fixed="2.2.12" reported="20080115" public="20080121" released="20090727">
+<cve name="CVE-2008-0456"/>
+<severity level="4">low</severity>
+<title>CRLF injection in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible CRLF injection allowing HTTP response splitting attacks for sites
+which use mod_negotiation and allow untrusted uploads to locations which have
+MultiViews enabled.
+</p></description>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
<issue fixed="2.2.10" public="20080805" reported="20080728" released="20081031">
<cve name="CVE-2008-2939"/>
<severity level="4">low</severity>
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_22.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_22.html Wed Sep 19 13:34:33 2012
@@ -83,7 +83,49 @@ in a "-dev" release then this means that
the development source tree and will be part of an upcoming full release.</p><p> This page is created from a database of vulnerabilities originally
populated by Apache Week. Please send comments or corrections for
these vulnerabilities to the <a href="/security_report.html">Security
-Team</a>. </p><h1 id="2.2.22">
+Team</a>. </p><h1 id="2.2.23-dev">
+Fixed in Apache httpd 2.2.23-dev</h1><dl>
+ <dd>
+ <b>low: </b>
+ <b>
+ <name name="CVE-2012-2687">XSS in mod_negotiation when untrusted uploads are supported</name>
+ </b>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2687">CVE-2012-2687</a>
+ <p>
+Possible XSS for sites which use mod_negotiation and allow
+untrusted uploads to locations which have MultiViews enabled.
+</p>
+ <p>Note: This issue is also known as CVE-2008-0455.</p>
+ </dd>
+ <dd>
+ Reported to security team: 31st May 2012<br/>
+ Issue public: 13th June 2012<br/></dd>
+ <dd/>
+ <dd>
+ Affects:
+ 2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+ <dd>
+ <b>low: </b>
+ <b>
+ <name name="CVE-2012-0883">insecure LD_LIBRARY_PATH handling</name>
+ </b>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883">CVE-2012-0883</a>
+ <p>
+Insecure handling of LD_LIBRARY_PATH was found that could
+lead to the current working directory to be searched for DSOs.
+This could allow a local user to execute code as root if an
+administrator runs apachectl from an untrusted directory.
+</p>
+ </dd>
+ <dd>
+ Reported to security team: 14th February 2012<br/>
+ Issue public: 2nd March 2012<br/></dd>
+ <dd>
+ Update Released: 17th April 2012<br/></dd>
+ <dd>
+ Affects:
+ 2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+</dl><h1 id="2.2.22">
Fixed in Apache httpd 2.2.22</h1><dl>
<dd>
<b>low: </b>
@@ -725,6 +767,26 @@ from executing commands from a Server-Si
Affects:
2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
<dd>
+ <b>low: </b>
+ <b>
+ <name name="CVE-2008-0456">CRLF injection in mod_negotiation when untrusted uploads are supported</name>
+ </b>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0456">CVE-2008-0456</a>
+ <p>
+Possible CRLF injection allowing HTTP response splitting attacks for sites
+which use mod_negotiation and allow untrusted uploads to locations which have
+MultiViews enabled.
+</p>
+ </dd>
+ <dd>
+ Reported to security team: 15th January 2008<br/>
+ Issue public: 21st January 2008<br/></dd>
+ <dd>
+ Update Released: 27th July 2009<br/></dd>
+ <dd>
+ Affects:
+ 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p/></dd>
+ <dd>
<b>moderate: </b>
<b>
<name name="CVE-2009-1956">APR-util off-by-one overflow</name>
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_24.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_24.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_24.html Wed Sep 19 13:34:33 2012
@@ -115,6 +115,7 @@ between users.
Possible XSS for sites which use mod_negotiation and allow
untrusted uploads to locations which have MultiViews enabled.
</p>
+ <p>Note: This issue is also known as CVE-2008-0455.</p>
</dd>
<dd>
Reported to security team: 31st May 2012<br/>