File _patchinfo of Package patchinfo.511

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.511

<patchinfo incident="511">
  <issue id="871310" tracker="bnc">VUL-1: CVE-2013-5704: apache2: bypass of mod_headers rules via chunked requests</issue>
  <issue id="899836" tracker="bnc">VUL-1: CVE-2014-3581: apache2: [NULL ptr DoS in mod_cache]</issue>
  <issue id="792309" tracker="bnc">systemd: Apache2 fails to start (timeout) at boot when mod_ssl enabled</issue>
  <issue id="918352" tracker="bnc">VUL-1: CVE-2015-0228: apache2: mod_lua websocket DoS</issue>
  <issue id="909715" tracker="bnc">VUL-0: CVE-2014-8109: apache2: mod_lua: LuaAuthzProvider uses wrong arguments</issue>
  <issue id="923090" tracker="bnc">apache2 missing imagemap module</issue>
  <issue id="CVE-2014-8109" tracker="cve" />
  <issue id="CVE-2013-5704" tracker="cve" />
  <issue id="CVE-2014-3581" tracker="cve" />
  <issue id="CVE-2015-0228" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>kstreitova</packager>
  <description>Apache2 updated to fix four security issues and one non-security bug.

The following vulnerabilities have been fixed:

- mod_headers rules could be bypassed via chunked requests. Adds "MergeTrailers"
  directive to restore legacy behavior. (bsc#871310, CVE-2013-5704)
- An empty value in Content-Type could lead to a crash through a null pointer
  dereference and a denial of service. (bsc#899836, CVE-2014-3581)
- Remote attackers could bypass intended access restrictions in mod_lua
  LuaAuthzProvider when multiple Require directives with different arguments
  are used. (bsc#909715, CVE-2014-8109)
- Remote attackers could cause a denial of service (child-process crash) by
  sending a crafted WebSocket Ping frame after a Lua script has called the
  wsupgrade function. (bsc#918352, CVE-2015-0228)

The following non-security issues have been fixed:

- The Apache2 systemd service file was changed to fix situation where apache wouldn't
  start at boot when using an encrypted certificate because the user wasn't prompted
  for password during boot. (bsc#792309)

Additionally, mod_imagemap is now included by default in the package. (bsc#923090)
</description>
  <summary>Security update for apache2</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.511

Places