apache2 - security update

2014-10-1600:00:00

Google

osv.dev

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.974 High

EPSS

Percentile

99.8%

JSON

This update fixes two security issues with apache2.

CVE-2013-5704
Disable the possibility to replace HTTP headers with HTTP trailers
as this could be used to circumvent earlier header operations made by
other modules. This can be restored with a new MergeTrailers
directive.
CVE-2014-3581
Fix denial of service where Apache can segfault when mod_cache is used
and when the cached request contains an empty Content-Type header.

For Debian 6 Squeeze, these issues have been fixed in apache2 version 2.2.16-6+squeeze14

CPENameOperatorVersion
apache2eq2.2.16-6
apache2eq2.2.16-6+squeeze1
apache2eq2.2.16-6+squeeze10
apache2eq2.2.16-6+squeeze11
apache2eq2.2.16-6+squeeze12
apache2eq2.2.16-6+squeeze13
apache2eq2.2.16-6+squeeze1~bpo50+1
apache2eq2.2.16-6+squeeze2
apache2eq2.2.16-6+squeeze2~bpo50+1
apache2eq2.2.16-6+squeeze3

Name	Operator	Version
apache2	eq	2.2.16-6
apache2	eq	2.2.16-6+squeeze1
apache2	eq	2.2.16-6+squeeze10
apache2	eq	2.2.16-6+squeeze11
apache2	eq	2.2.16-6+squeeze12
apache2	eq	2.2.16-6+squeeze13
apache2	eq	2.2.16-6+squeeze1~bpo50+1
apache2	eq	2.2.16-6+squeeze2
apache2	eq	2.2.16-6+squeeze2~bpo50+1
apache2	eq	2.2.16-6+squeeze3