You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by mj...@apache.org on 2006/07/27 21:24:36 UTC
svn commit: r426205 -
/httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml
Author: mjc
Date: Thu Jul 27 12:24:36 2006
New Revision: 426205
URL: http://svn.apache.org/viewvc?rev=426205&view=rev
Log:
Add details of latest issue
Modified:
httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml
Modified: httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml?rev=426205&r1=426204&r2=426205&view=diff
==============================================================================
--- httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml (original)
+++ httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml Thu Jul 27 12:24:36 2006
@@ -1,4 +1,67 @@
-<security updated="20060703">
+<security updated="20060727">
+
+<issue fixed="2.2.3" public="20060727" reported="20060721" released="20060727">
+<cve name="CVE-2006-3747"/>
+<severity level="2">important</severity>
+<title>mod_rewrite off-by-one error</title>
+<description>
+<p>
+An off-by-one flaw exists in the Rewrite module, mod_rewrite.
+Depending on the manner in which Apache httpd was compiled, this
+software defect may result in a vulnerability which, in combination
+with certain types of Rewrite rules in the web server configuration
+files, could be triggered remotely. For vulnerable builds, the nature
+of the vulnerability can be denial of service (crashing of web server
+processes) or potentially allow arbitrary code execution.
+</p>
+</description>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
+<issue fixed="2.0.59" public="20060727" reported="20060721" released="20060727">
+<cve name="CVE-2006-3747"/>
+<severity level="2">important</severity>
+<title>mod_rewrite off-by-one error</title>
+<description>
+<p>
+An off-by-one flaw exists in the Rewrite module, mod_rewrite.
+Depending on the manner in which Apache httpd was compiled, this
+software defect may result in a vulnerability which, in combination
+with certain types of Rewrite rules in the web server configuration
+files, could be triggered remotely. For vulnerable builds, the nature
+of the vulnerability can be denial of service (crashing of web server
+processes) or potentially allow arbitrary code execution.
+</p>
+</description>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+</issue>
+
+<issue fixed="1.3.37" public="20060727" reported="20060721" released="20060727">
+<cve name="CVE-2006-3747"/>
+<severity level="2">important</severity>
+<title>mod_rewrite off-by-one error</title>
+<description>
+<p>
+An off-by-one flaw exists in the Rewrite module, mod_rewrite.
+Depending on the manner in which Apache httpd was compiled, this
+software defect may result in a vulnerability which, in combination
+with certain types of Rewrite rules in the web server configuration
+files, could be triggered remotely. For vulnerable builds, the nature
+of the vulnerability can be denial of service (crashing of web server
+processes) or potentially allow arbitrary code execution.
+</p>
+</description>
+</issue>
<issue fixed="2.2.2" public="20051212" reported="20051205" released="20060501">
<cve name="CVE-2005-3357"/>
@@ -13,7 +76,12 @@
crash would only be a denial of service if using the worker MPM.
</p>
</description>
-<affects prod="httpd" version="2.2.0"/>
+<affects prod="httpd" version="1.3.34"/>
+<affects prod="httpd" version="1.3.33"/>
+<affects prod="httpd" version="1.3.32"/>
+<affects prod="httpd" version="1.3.31"/>
+<affects prod="httpd" version="1.3.29"/>
+<affects prod="httpd" version="1.3.28"/>
</issue>
<issue fixed="2.0.58" public="20051212" reported="20051205" released="20060501">