[SECURITY] [DLA 71-1] apache2 security update

2014-10-1610:10:29

lists.debian.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.3 Medium

AI Score

Confidence

Low

0.467 Medium

EPSS

Percentile

97.5%

JSON

Package : apache2
Version : 2.2.16-6+squeeze14
CVE ID : CVE-2013-5704 CVE-2014-3581

This update fixes two security issues with apache2.

CVE-2013-5704

Disable the possibility to replace HTTP headers with HTTP trailers
as this could be used to circumvent earlier header operations made by
other modules. This can be restored with a new MergeTrailers
directive.

CVE-2014-3581

Fix denial of service where Apache can segfault when mod_cache is used
and when the cached request contains an empty Content-Type header.

–
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian6i386apache2-suexec-custom< 2.2.16-6+squeeze14apache2-suexec-custom_2.2.16-6+squeeze14_i386.deb
Debian6amd64apache2-suexec< 2.2.16-6+squeeze14apache2-suexec_2.2.16-6+squeeze14_amd64.deb
Debian6amd64apache2-prefork-dev< 2.2.16-6+squeeze14apache2-prefork-dev_2.2.16-6+squeeze14_amd64.deb
Debian6i386apache2.2-common< 2.2.16-6+squeeze14apache2.2-common_2.2.16-6+squeeze14_i386.deb
Debian6amd64apache2-mpm-prefork< 2.2.16-6+squeeze14apache2-mpm-prefork_2.2.16-6+squeeze14_amd64.deb
Debian6amd64apache2-mpm-worker< 2.2.16-6+squeeze14apache2-mpm-worker_2.2.16-6+squeeze14_amd64.deb
Debian6i386apache2.2-bin< 2.2.16-6+squeeze14apache2.2-bin_2.2.16-6+squeeze14_i386.deb
Debian6i386apache2-threaded-dev< 2.2.16-6+squeeze14apache2-threaded-dev_2.2.16-6+squeeze14_i386.deb
Debian6amd64apache2-suexec-custom< 2.2.16-6+squeeze14apache2-suexec-custom_2.2.16-6+squeeze14_amd64.deb
Debian6amd64apache2-mpm-event< 2.2.16-6+squeeze14apache2-mpm-event_2.2.16-6+squeeze14_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	apache2-suexec-custom	< 2.2.16-6+squeeze14	apache2-suexec-custom_2.2.16-6+squeeze14_i386.deb
Debian	6	amd64	apache2-suexec	< 2.2.16-6+squeeze14	apache2-suexec_2.2.16-6+squeeze14_amd64.deb
Debian	6	amd64	apache2-prefork-dev	< 2.2.16-6+squeeze14	apache2-prefork-dev_2.2.16-6+squeeze14_amd64.deb
Debian	6	i386	apache2.2-common	< 2.2.16-6+squeeze14	apache2.2-common_2.2.16-6+squeeze14_i386.deb
Debian	6	amd64	apache2-mpm-prefork	< 2.2.16-6+squeeze14	apache2-mpm-prefork_2.2.16-6+squeeze14_amd64.deb
Debian	6	amd64	apache2-mpm-worker	< 2.2.16-6+squeeze14	apache2-mpm-worker_2.2.16-6+squeeze14_amd64.deb
Debian	6	i386	apache2.2-bin	< 2.2.16-6+squeeze14	apache2.2-bin_2.2.16-6+squeeze14_i386.deb
Debian	6	i386	apache2-threaded-dev	< 2.2.16-6+squeeze14	apache2-threaded-dev_2.2.16-6+squeeze14_i386.deb
Debian	6	amd64	apache2-suexec-custom	< 2.2.16-6+squeeze14	apache2-suexec-custom_2.2.16-6+squeeze14_amd64.deb
Debian	6	amd64	apache2-mpm-event	< 2.2.16-6+squeeze14	apache2-mpm-event_2.2.16-6+squeeze14_amd64.deb