svn commit: r1387590 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml

[mj...@apache.org]

Author: mjc
Date: Wed Sep 19 13:34:28 2012
New Revision: 1387590

URL: http://svn.apache.org/viewvc?rev=1387590&view=rev
Log:
Updates suggested by thoger@redhat.com

Modified:
    httpd/site/trunk/content/security/vulnerabilities-httpd.xml

Modified: httpd/site/trunk/content/security/vulnerabilities-httpd.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/content/security/vulnerabilities-httpd.xml?rev=1387590&r1=1387589&r2=1387590&view=diff
==============================================================================
--- httpd/site/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ httpd/site/trunk/content/security/vulnerabilities-httpd.xml Wed Sep 19 13:34:28 2012
@@ -1,4 +1,37 @@
-<security updated="20120418">
+<security updated="20120920">
+
+<issue fixed="2.2.23-dev" reported="20120531" public="20120613">
+<cve name="CVE-2012-2687"/>
+<severity level="4">low</severity>
+<title>XSS in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible XSS for sites which use mod_negotiation and allow
+untrusted uploads to locations which have MultiViews enabled.
+</p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
 
 <issue fixed="2.4.3" reported="20120531" public="20120613" released="20120821">
 <cve name="CVE-2012-2687"/>
@@ -8,6 +41,7 @@
 Possible XSS for sites which use mod_negotiation and allow
 untrusted uploads to locations which have MultiViews enabled.
 </p>
+<p>Note: This issue is also known as CVE-2008-0455.</p>
 </description>
 <affects prod="httpd" version="2.4.2"/>
 <affects prod="httpd" version="2.4.1"/>
@@ -28,6 +62,40 @@ between users.
 <affects prod="httpd" version="2.4.1"/>
 </issue>
 
+<issue fixed="2.2.23-dev" reported="20120214" public="20120302" released="20120417">
+<cve name="CVE-2012-0883"/>
+<severity level="4">low</severity>
+<title>insecure LD_LIBRARY_PATH handling</title>
+<description><p>
+Insecure handling of LD_LIBRARY_PATH was found that could
+lead to the current working directory to be searched for DSOs.
+This could allow a local user to execute code as root if an
+administrator runs apachectl from an untrusted directory.
+</p>
+</description>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
 <issue fixed="2.4.2" reported="20120214" public="20120302" released="20120417">
 <cve name="CVE-2012-0883"/>
 <severity level="4">low</severity>
@@ -1248,6 +1316,27 @@ processed by the pattern preparation eng
 <affects prod="httpd" version="2.2.0"/>
 </issue>
 
+<issue fixed="2.2.12" reported="20080115" public="20080121" released="20090727">
+<cve name="CVE-2008-0456"/>
+<severity level="4">low</severity>
+<title>CRLF injection in mod_negotiation when untrusted uploads are supported</title>
+<description><p>
+Possible CRLF injection allowing HTTP response splitting attacks for sites
+which use mod_negotiation and allow untrusted uploads to locations which have
+MultiViews enabled. 
+</p></description>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
 <issue fixed="2.2.10" public="20080805" reported="20080728" released="20081031">
 <cve name="CVE-2008-2939"/>
 <severity level="4">low</severity>