[SECURITY] [DLA 284-1] apache2 security update

2015-07-2821:31:48

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.072 Low

EPSS

Percentile

93.9%

JSON

Package : apache2
Version : 2.2.16-6+squeeze15
CVE ID : CVE-2015-3183

A vulnerability has been found in the Apache HTTP Server.

CVE-2015-3183

Apache HTTP Server did not properly parse chunk headers, which
allowed remote attackers to conduct HTTP request smuggling via a
crafted request. This flaw relates to mishandling of large
chunk-size values and invalid chunk-extension characters in
modules/http/http_filters.c.

For the squeeze distribution, these issues have been fixed in version
2.2.16-6+squeeze15 of apache2.

We recommend you to upgrade your apache2 packages.
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian7armhfapache2-suexec-custom< 2.2.22-13+deb7u5apache2-suexec-custom_2.2.22-13+deb7u5_armhf.deb
Debian7s390xapache2.2-common< 2.2.22-13+deb7u5apache2.2-common_2.2.22-13+deb7u5_s390x.deb
Debian6i386apache2-mpm-worker< 2.2.16-6+squeeze15apache2-mpm-worker_2.2.16-6+squeeze15_i386.deb
Debian8s390xlibapache2-mod-proxy-html< 1:2.4.10-10+deb8u1libapache2-mod-proxy-html_1:2.4.10-10+deb8u1_s390x.deb
Debian7sparcapache2-mpm-itk< 2.2.22-13+deb7u5apache2-mpm-itk_2.2.22-13+deb7u5_sparc.deb
Debian7kfreebsd-amd64apache2< 2.2.22-13+deb7u5apache2_2.2.22-13+deb7u5_kfreebsd-amd64.deb
Debian8arm64apache2-mpm-event< 2.4.10-10+deb8u1apache2-mpm-event_2.4.10-10+deb8u1_arm64.deb
Debian8amd64apache2-suexec-custom< 2.4.10-10+deb8u1apache2-suexec-custom_2.4.10-10+deb8u1_amd64.deb
Debian8ppc64elapache2.2-bin< 2.4.10-10+deb8u1apache2.2-bin_2.4.10-10+deb8u1_ppc64el.deb
Debian6amd64apache2-mpm-worker< 2.2.16-6+squeeze15apache2-mpm-worker_2.2.16-6+squeeze15_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	armhf	apache2-suexec-custom	< 2.2.22-13+deb7u5	apache2-suexec-custom_2.2.22-13+deb7u5_armhf.deb
Debian	7	s390x	apache2.2-common	< 2.2.22-13+deb7u5	apache2.2-common_2.2.22-13+deb7u5_s390x.deb
Debian	6	i386	apache2-mpm-worker	< 2.2.16-6+squeeze15	apache2-mpm-worker_2.2.16-6+squeeze15_i386.deb
Debian	8	s390x	libapache2-mod-proxy-html	< 1:2.4.10-10+deb8u1	libapache2-mod-proxy-html_1:2.4.10-10+deb8u1_s390x.deb
Debian	7	sparc	apache2-mpm-itk	< 2.2.22-13+deb7u5	apache2-mpm-itk_2.2.22-13+deb7u5_sparc.deb
Debian	7	kfreebsd-amd64	apache2	< 2.2.22-13+deb7u5	apache2_2.2.22-13+deb7u5_kfreebsd-amd64.deb
Debian	8	arm64	apache2-mpm-event	< 2.4.10-10+deb8u1	apache2-mpm-event_2.4.10-10+deb8u1_arm64.deb
Debian	8	amd64	apache2-suexec-custom	< 2.4.10-10+deb8u1	apache2-suexec-custom_2.4.10-10+deb8u1_amd64.deb
Debian	8	ppc64el	apache2.2-bin	< 2.4.10-10+deb8u1	apache2.2-bin_2.4.10-10+deb8u1_ppc64el.deb
Debian	6	amd64	apache2-mpm-worker	< 2.2.16-6+squeeze15	apache2-mpm-worker_2.2.16-6+squeeze15_amd64.deb