kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/www/apache/patches/patch-ai

15 lines
511 B
Text
Raw Normal View History

Update apache to 1.3.41. Changes with Apache 1.3.41 *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox] Changes with Apache 1.3.40 (not released) *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imap: Fix cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) SECURITY: CVE-2007-3847 (cve.mitre.org) mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. With Apache 1.3, the denial of service vulnerability applies only to the Windows and NetWare platforms. [Jeff Trawick] *) More efficient implementation of the CVE-2007-3304 PID table patch. This fixes issues with excessive memory usage by the parent process if long-running and with a high number of child process forks during that timeframe. Also fixes bogus "Bad pid" errors. [Jim Jagielski, Jeff Trawick] Changes with Apache 1.3.39 *) SECURITY: CVE-2006-5752 (cve.mitre.org) mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser. [Joe Orton] *) SECURITY: CVE-2007-3304 (cve.mitre.org) Ensure that the parent process cannot be forced to kill non-child processes by checking scoreboard PID data with parent process privately stored PID data. [Jim Jagielski] *) mime.types: Many updates to sync with IANA registry and common unregistered types that the owners refuse to register. Admins are encouraged to update their installed mime.types file. pr: 35550, 37798, 39317, 31483 [Roy T. Fielding] There was no Apache 1.3.38
2008-02-23 06:16:33 +01:00
$NetBSD: patch-ai,v 1.11 2008/02/23 05:16:34 obache Exp $
Bump version to `1.3.3.2' - add `timefmt' argument to ap_include_extern_func's (needed for a couple upcoming XSSI-extending modules). Also fix apxs to use `install' and fix the cgi-bin `preservation' while we're here.
1998-12-04 18:23:19 +01:00
Update apache to 1.3.41. Changes with Apache 1.3.41 *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox] Changes with Apache 1.3.40 (not released) *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imap: Fix cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) SECURITY: CVE-2007-3847 (cve.mitre.org) mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. With Apache 1.3, the denial of service vulnerability applies only to the Windows and NetWare platforms. [Jeff Trawick] *) More efficient implementation of the CVE-2007-3304 PID table patch. This fixes issues with excessive memory usage by the parent process if long-running and with a high number of child process forks during that timeframe. Also fixes bogus "Bad pid" errors. [Jim Jagielski, Jeff Trawick] Changes with Apache 1.3.39 *) SECURITY: CVE-2006-5752 (cve.mitre.org) mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser. [Joe Orton] *) SECURITY: CVE-2007-3304 (cve.mitre.org) Ensure that the parent process cannot be forced to kill non-child processes by checking scoreboard PID data with parent process privately stored PID data. [Jim Jagielski] *) mime.types: Many updates to sync with IANA registry and common unregistered types that the owners refuse to register. Admins are encouraged to update their installed mime.types file. pr: 35550, 37798, 39317, 31483 [Roy T. Fielding] There was no Apache 1.3.38
2008-02-23 06:16:33 +01:00
--- src/support/apxs.pl.orig 2008-02-23 04:22:56.000000000 +0000
Update www/apache to 1.3.24 with EAPI patch from mod_ssl-2.8.8-1.3.24. Relevant changes from version 1.3.23 include: * Prevent invalid client hostnames from appearing in the log file. * Various mod_proxy improvements, such as the new ProxyIOBufferSize directive. * The new ''IgnoreCase' keyword to the IndexOptions directive. * mod_rewrite's 'rnd' was broken and has been fixed. * The '-S' option of 'apxs' was not able to handle quotes; also 'apxs' is now rebuilt when options are changed. * proxy now correctly handles Cookies and X-Cache headers. * Fixed a problem in TPF when we were using the wrong subpool when opening the error log. * pthread accept() mutexes on Solaris were broken (since we were not linking against pthread)
2002-04-02 16:13:01 +02:00
+++ src/support/apxs.pl
Update apache to 1.3.41. Changes with Apache 1.3.41 *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox] Changes with Apache 1.3.40 (not released) *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imap: Fix cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) SECURITY: CVE-2007-3847 (cve.mitre.org) mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. With Apache 1.3, the denial of service vulnerability applies only to the Windows and NetWare platforms. [Jeff Trawick] *) More efficient implementation of the CVE-2007-3304 PID table patch. This fixes issues with excessive memory usage by the parent process if long-running and with a high number of child process forks during that timeframe. Also fixes bogus "Bad pid" errors. [Jim Jagielski, Jeff Trawick] Changes with Apache 1.3.39 *) SECURITY: CVE-2006-5752 (cve.mitre.org) mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser. [Joe Orton] *) SECURITY: CVE-2007-3304 (cve.mitre.org) Ensure that the parent process cannot be forced to kill non-child processes by checking scoreboard PID data with parent process privately stored PID data. [Jim Jagielski] *) mime.types: Many updates to sync with IANA registry and common unregistered types that the owners refuse to register. Admins are encouraged to update their installed mime.types file. pr: 35550, 37798, 39317, 31483 [Roy T. Fielding] There was no Apache 1.3.38
2008-02-23 06:16:33 +01:00
@@ -424,8 +424,7 @@ if ($opt_i or $opt_e) {
Update apache to 1.3.20. Relevant changes from version 1.3.19 include: NetBSD Packages Collection (pkgsrc) changes: * Modify French page in same way as the English page. Translation provided by Remi Zara <remi_zara@mac.com> in private e-mail. * Use EAPI patches from mod_ssl-2.8.4-1.3.20. * Unify repeated SED replacement info for config.layout, apache.sh, DEINSTALL, and INSTALL into one location, FILES_SUBST. * Modify patch to apxs to use 0:0 instead of root:wheel, as some non-NetBSD systems don't have a wheel group. The general bug fixes: * Eliminate a potential segfault if an invalid floating point value is passed to the ap_snprintf() function, on platforms supporting isnan() and isinf(). * Fix a possible segfault at startup in the detection of a default ServerName or IP string when no ServerName was specified. * Fixed mod_proxy to retain empty headers, as allowed by RFC2068. * Properly resolve the location of ndbm on Linux and some glibc2 builds, where ndbm.h is in the nonstandard db1/ subdir. The main new features include: * Enhanced rotatelogs to allow a UTC offset to be specified, and the format logfile names with human-readable date/time stamps. * Added the NOESCAPE (NS) flag to RewriteRule, to disable *all* normal URI escaping. Note incautious use can give unexpected results or introduce security risks. * Added the '\' character to RewriteRule to allow escaping of special characters. Allows embedding of both the '$' and '%' characters in the results, so 'foo\$1' translates to 'foo$1' rather than 'foo\<value of $1>'. * Added the -V flag to suexec, to display the compile-time settings with which it was built. (Only valid for root or the HTTPD_USER username.) * Introduced EBCDIC conversion configuration options, controlling the conversion based on MIME type or file suffix.
2001-06-09 08:36:42 +02:00
if ($^O ne "MSWin32") {
$t =~ s|^.+/([^/]+)$|$1|;
if ($opt_i) {
- push(@cmds, "cp $f $CFG_LIBEXECDIR/$t");
- push(@cmds, "chmod 755 $CFG_LIBEXECDIR/$t");
Revert rev 1.9, do not expand @INSTALL@, it's done in post-patch. (hi abs!)
2004-11-15 20:13:41 +01:00
+ push(@cmds, "@INSTALL@ $f $CFG_LIBEXECDIR/$t");
Update apache to 1.3.20. Relevant changes from version 1.3.19 include: NetBSD Packages Collection (pkgsrc) changes: * Modify French page in same way as the English page. Translation provided by Remi Zara <remi_zara@mac.com> in private e-mail. * Use EAPI patches from mod_ssl-2.8.4-1.3.20. * Unify repeated SED replacement info for config.layout, apache.sh, DEINSTALL, and INSTALL into one location, FILES_SUBST. * Modify patch to apxs to use 0:0 instead of root:wheel, as some non-NetBSD systems don't have a wheel group. The general bug fixes: * Eliminate a potential segfault if an invalid floating point value is passed to the ap_snprintf() function, on platforms supporting isnan() and isinf(). * Fix a possible segfault at startup in the detection of a default ServerName or IP string when no ServerName was specified. * Fixed mod_proxy to retain empty headers, as allowed by RFC2068. * Properly resolve the location of ndbm on Linux and some glibc2 builds, where ndbm.h is in the nonstandard db1/ subdir. The main new features include: * Enhanced rotatelogs to allow a UTC offset to be specified, and the format logfile names with human-readable date/time stamps. * Added the NOESCAPE (NS) flag to RewriteRule, to disable *all* normal URI escaping. Note incautious use can give unexpected results or introduce security risks. * Added the '\' character to RewriteRule to allow escaping of special characters. Allows embedding of both the '$' and '%' characters in the results, so 'foo\$1' translates to 'foo$1' rather than 'foo\<value of $1>'. * Added the -V flag to suexec, to display the compile-time settings with which it was built. (Only valid for root or the HTTPD_USER username.) * Introduced EBCDIC conversion configuration options, controlling the conversion based on MIME type or file suffix.
2001-06-09 08:36:42 +02:00
}
Update Apache package to version 1.3.9 (SSL Module 2.4.8) using patches suppled by SUNAGAWA Keiki in PR pkg/8819. This version mostly fixes bugs discovered since version 1.3.6.
1999-11-21 23:09:26 +01:00
}
Update apache to 1.3.20. Relevant changes from version 1.3.19 include: NetBSD Packages Collection (pkgsrc) changes: * Modify French page in same way as the English page. Translation provided by Remi Zara <remi_zara@mac.com> in private e-mail. * Use EAPI patches from mod_ssl-2.8.4-1.3.20. * Unify repeated SED replacement info for config.layout, apache.sh, DEINSTALL, and INSTALL into one location, FILES_SUBST. * Modify patch to apxs to use 0:0 instead of root:wheel, as some non-NetBSD systems don't have a wheel group. The general bug fixes: * Eliminate a potential segfault if an invalid floating point value is passed to the ap_snprintf() function, on platforms supporting isnan() and isinf(). * Fix a possible segfault at startup in the detection of a default ServerName or IP string when no ServerName was specified. * Fixed mod_proxy to retain empty headers, as allowed by RFC2068. * Properly resolve the location of ndbm on Linux and some glibc2 builds, where ndbm.h is in the nonstandard db1/ subdir. The main new features include: * Enhanced rotatelogs to allow a UTC offset to be specified, and the format logfile names with human-readable date/time stamps. * Added the NOESCAPE (NS) flag to RewriteRule, to disable *all* normal URI escaping. Note incautious use can give unexpected results or introduce security risks. * Added the '\' character to RewriteRule to allow escaping of special characters. Allows embedding of both the '$' and '%' characters in the results, so 'foo\$1' translates to 'foo$1' rather than 'foo\<value of $1>'. * Added the -V flag to suexec, to display the compile-time settings with which it was built. (Only valid for root or the HTTPD_USER username.) * Introduced EBCDIC conversion configuration options, controlling the conversion based on MIME type or file suffix.
2001-06-09 08:36:42 +02:00
else {
Reference in a new issue Copy permalink