apache2 security update
This update fixes several security issues in the Apache2
webserver.
CVE-2011-3368, CVE-2011-4317: This update also includes
several fixes for a mod_proxy reverse exposure via
RewriteRule or ProxyPassMatch directives.
CVE-2011-3607: Integer overflow in ap_pregsub function
resulting in a heap based buffer overflow could potentially
allow local attackers to gain privileges
In addition to that the following changes were made:
- new template file:
/etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1
only, browser match stuff commented out.
- rc script /etc/init.d/apache2: handle reload with deleted
binaries by message to stdout only, but refrain from
sending signals.
-
Submitted by
Adrian Schröter (adrianSuSE)
- Version 5520
Fixed bugs
bnc#722545
VUL-1: CVE-2011-3368: apache2: mod_proxy reverse proxy exposure
bnc#729181
VUL-0: CVE-2011-3607: apache2: integer overflow leading to a heap buffer overflow