You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@apr.apache.org by tr...@apache.org on 2010/02/25 16:36:36 UTC

svn commit: r76 - /release/apr/CHANGES-APR-UTIL-0.9

Author: trawick
Date: Thu Feb 25 10:36:35 2010
New Revision: 76

Log:
Add one missing SECURITY flag as well as a couple of CVE
ids for this highly-visible APR-Util 0.9.17 CHANGES file.

Modified:
    release/apr/CHANGES-APR-UTIL-0.9

Modified: release/apr/CHANGES-APR-UTIL-0.9
==============================================================================
--- release/apr/CHANGES-APR-UTIL-0.9 (original)
+++ release/apr/CHANGES-APR-UTIL-0.9 Thu Feb 25 10:36:35 2010
@@ -1,7 +1,7 @@
                                                      -*- coding: utf-8 -*-
 Changes with APR-util 0.9.17
 
-  *) SECURITY:
+  *) SECURITY: CVE-2009-1955 (cve.mitre.org)
      Fix a denial of service attack against the apr_xml_* interface
      using the "billion laughs" entity expansion technique.
      [Joe Orton]
@@ -12,7 +12,8 @@
      Fix underflow in apr_strmatch_precompile.
      [Matthew Palmer <mpalmer debian.org>]
 
-  *) Fix off by one overflow in apr_brigade_vprintf.
+  *) SECURITY: CVE-2009-1956 (cve.mitre.org)
+     Fix off by one overflow in apr_brigade_vprintf.
      [C. Michael Pilato <cmpilato collab.net>]
 
   *) Better error detection for bucket allocation failures.