lighttpd - several vulnerabilities

Several vulnerabilities were discovered in lighttpd, a fast webserver with
minimal memory footprint, which could allow the execution of arbitrary code via
the overflow of CGI variables when mod_fcgi was enabled. The Common
Vulnerabilities and Exposures project identifies the following problems:

• CVE-2007-3946
  The use of mod_auth could leave to a denial of service attack crashing
  the webserver.
• CVE-2007-3947
  The improper handling of repeated HTTP headers could cause a denial
  of service attack crashing the webserver.
• CVE-2007-3949
  A bug in mod_access potentially allows remote users to bypass
  access restrictions via trailing slash characters.
• CVE-2007-3950
  On 32-bit platforms users may be able to create denial of service
  attacks, crashing the webserver, via mod_webdav, mod_fastcgi, or
  mod_scgi.

For the stable distribution (etch), these problems have been fixed in version
1.4.13-4etch4.

For the unstable distribution (sid), these problems have been fixed in
version 1.4.16-1.

We recommend that you upgrade your lighttpd package.