kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/www/apache22/distinfo

20 lines
1.1 KiB
Text
Raw Normal View History

patch for CVE-2012-0883 taken from the Apache SVN bump pkgrev
2012-04-22 21:08:03 +02:00
$NetBSD: distinfo,v 1.51 2012/04/22 19:08:03 spz Exp $
Apache 2.2.3 - latest stable version. Please see http://httpd.apache.org/docs/2.2/new_features_2_2.html for the list of changes.
2006-12-09 00:31:52 +01:00
Update "apache" package to version 2.2.22. Changes since 2.2.21: - SECURITY: CVE-2011-3368 (cve.mitre.org) Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations. [Joe Orton] - SECURITY: CVE-2011-3607 (cve.mitre.org) Fix integer overflow in ap_pregsub() which, when the mod_setenvif module is enabled, could allow local users to gain privileges via a .htaccess file. [Stefan Fritsch, Greg Ames] - SECURITY: CVE-2011-4317 (cve.mitre.org) Resolve additional cases of URL rewriting with ProxyPassMatch or RewriteRule, where particular request-URIs could result in undesired backend network exposure in some configurations. [Joe Orton] - SECURITY: CVE-2012-0021 (cve.mitre.org) mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format string is in use and a client sends a nameless, valueless cookie, causing a denial of service. The issue existed since version 2.2.17. Bug#52256. [Rainer Canavan <rainer-apache 7val com>] - SECURITY: CVE-2012-0031 (cve.mitre.org) Fix scoreboard issue which could allow an unprivileged child process could cause the parent to crash at shutdown rather than terminate cleanly. [Joe Orton] - SECURITY: CVE-2012-0053 (cve.mitre.org) Fix an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400. [Eric Covener] - mod_proxy_ajp: Try to prevent a single long request from marking a worker in error. [Jean-Frederic Clere] - config: Update the default mod_ssl configuration: Disable SSLv2, only allow >= 128bit ciphers, add commented example for speed optimized cipher list, limit MSIE workaround to MSIE <= 5. [Kaspar Brand] - core: Fix segfault in ap_send_interim_response(). Bug#52315. [Stefan Fritsch] - mod_log_config: Prevent segfault. Bug#50861. [Torsten Foertsch <torsten.foertsch gmx.net>] - mod_win32: Invert logic for env var UTF-8 fixing. Now we exclude a list of vars which we know for sure they dont hold UTF-8 chars; all other vars will be fixed. This has the benefit that now also all vars from 3rd-party modules will be fixed. Bug#13029 / 34985. [Guenter Knauf] - core: Fix hook sorting for Perl modules, a regression introduced in 2.2.21. Bug#45076. [Torsten Foertsch <torsten foertsch gmx net>] - Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20: A range of '0-' will now return 206 instead of 200. Bug#51878. [Jim Jagielski] - Example configuration: Fix entry for MaxRanges (use "unlimited" instead of "0"). [Rainer Jung] - mod_substitute: Fix buffer overrun. [Ruediger Pluem, Rainer Jung] Please note that all the security fixes had been integrated into "pkgsrc" as patches previously.
2012-02-01 20:53:21 +01:00
SHA1 (httpd-2.2.22.tar.bz2) = 766cd0843050a8dfb781e48b976f3ba6ebcf8696
RMD160 (httpd-2.2.22.tar.bz2) = 237a26a7759e7e1af175900d598e25fb082a4eb9
Size (httpd-2.2.22.tar.bz2) = 5378934 bytes
Fixes omiting of pre-creating directory for pax in patch-aa. It break installation on SUA 6.0 with native pax.
2010-04-28 09:43:56 +02:00
SHA1 (patch-aa) = e0bfdf6bc9cb034bea46a390a12a5508e363c9a7
Re-add patch-ab, fixes runtime error on Interix. It initially existed originally came from PR#27567 for www/apache2. CVE-2007-3304 parts was added in rev 1.2, then whole patch file was removed in rev 1.3 as update to apache-2.2.6, because the update contains fix for CVE-2007-3304 and comments of patch-ab only mentioned about the CVE. To prevent a recurrence of such a accident, added PR#27567 as comments for patch-ab.
2009-12-26 05:51:01 +01:00
SHA1 (patch-ab) = 365cc3b0ac2d9d68ccb94f5699fe168a1c9b0150
Apache 2.2.3 - latest stable version. Please see http://httpd.apache.org/docs/2.2/new_features_2_2.html for the list of changes.
2006-12-09 00:31:52 +01:00
SHA1 (patch-ac) = 515043b5c215d49fe8f6d3191b502c978e2a2dad
SHA1 (patch-ad) = 088d6ff0e7a8acfe70b4f85a6ce58d42c935fd13
SHA1 (patch-ae) = 86b307d6eefef232b6223afc3f69e64be40bd913
Update "apache" package to version 2.2.22. Changes since 2.2.21: - SECURITY: CVE-2011-3368 (cve.mitre.org) Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations. [Joe Orton] - SECURITY: CVE-2011-3607 (cve.mitre.org) Fix integer overflow in ap_pregsub() which, when the mod_setenvif module is enabled, could allow local users to gain privileges via a .htaccess file. [Stefan Fritsch, Greg Ames] - SECURITY: CVE-2011-4317 (cve.mitre.org) Resolve additional cases of URL rewriting with ProxyPassMatch or RewriteRule, where particular request-URIs could result in undesired backend network exposure in some configurations. [Joe Orton] - SECURITY: CVE-2012-0021 (cve.mitre.org) mod_log_config: Fix segfault (crash) when the '%{cookiename}C' log format string is in use and a client sends a nameless, valueless cookie, causing a denial of service. The issue existed since version 2.2.17. Bug#52256. [Rainer Canavan <rainer-apache 7val com>] - SECURITY: CVE-2012-0031 (cve.mitre.org) Fix scoreboard issue which could allow an unprivileged child process could cause the parent to crash at shutdown rather than terminate cleanly. [Joe Orton] - SECURITY: CVE-2012-0053 (cve.mitre.org) Fix an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400. [Eric Covener] - mod_proxy_ajp: Try to prevent a single long request from marking a worker in error. [Jean-Frederic Clere] - config: Update the default mod_ssl configuration: Disable SSLv2, only allow >= 128bit ciphers, add commented example for speed optimized cipher list, limit MSIE workaround to MSIE <= 5. [Kaspar Brand] - core: Fix segfault in ap_send_interim_response(). Bug#52315. [Stefan Fritsch] - mod_log_config: Prevent segfault. Bug#50861. [Torsten Foertsch <torsten.foertsch gmx.net>] - mod_win32: Invert logic for env var UTF-8 fixing. Now we exclude a list of vars which we know for sure they dont hold UTF-8 chars; all other vars will be fixed. This has the benefit that now also all vars from 3rd-party modules will be fixed. Bug#13029 / 34985. [Guenter Knauf] - core: Fix hook sorting for Perl modules, a regression introduced in 2.2.21. Bug#45076. [Torsten Foertsch <torsten foertsch gmx net>] - Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20: A range of '0-' will now return 206 instead of 200. Bug#51878. [Jim Jagielski] - Example configuration: Fix entry for MaxRanges (use "unlimited" instead of "0"). [Rainer Jung] - mod_substitute: Fix buffer overrun. [Ruediger Pluem, Rainer Jung] Please note that all the security fixes had been integrated into "pkgsrc" as patches previously.
2012-02-01 20:53:21 +01:00
SHA1 (patch-af) = 580950dbf0154ba1c93f5c58eae766c7d6c0c00c
Apache 2.2.3 - latest stable version. Please see http://httpd.apache.org/docs/2.2/new_features_2_2.html for the list of changes.
2006-12-09 00:31:52 +01:00
SHA1 (patch-ag) = 78dcb023f524ef65928b529320932c9664ec0d01
apr-config is called apr-1-config now.
2007-02-25 01:02:35 +01:00
SHA1 (patch-ai) = 4ebc3bd580a298973928eb6d13d2ce745eac0312
Apache 2.2.3 - latest stable version. Please see http://httpd.apache.org/docs/2.2/new_features_2_2.html for the list of changes.
2006-12-09 00:31:52 +01:00
SHA1 (patch-al) = 56b9f5c2f6fd01fe5067f9210e328cbf674c68f1
SHA1 (patch-am) = ab4a2f7e5a1a3064e908b61157e7fd349c0b0c08
QNX needs a little compatibility patch.
2009-02-16 00:14:40 +01:00
SHA1 (patch-aw) = ca53d67beeb2c2c4d9adb04d3d79e24a8c427fd4
Atomically create files when using DAV to stop files being deleted on error From: https://issues.apache.org/bugzilla/show_bug.cgi?id=39815 Bump PKGREVISION. OK tron@
2011-09-12 19:18:46 +02:00
SHA1 (patch-lock.c) = 770ca03f1cb4421879bd5baa5a7c30cc91acb6e1
SHA1 (patch-repos.c) = 0e0361b91d4b0fe6c7c55a12fdfd2e6aacc710e1
patch for CVE-2012-0883 taken from the Apache SVN bump pkgrev
2012-04-22 21:08:03 +02:00
SHA1 (patch-support_envvars-std.in) = 03e4989e104f4a1902a9135649d603f3e8d53d4c
Reference in a new issue Copy permalink