[SECURITY] DLA-862-1: sitesummary regression update

Package : sitesummary Version : 0.1.8+deb7u2 Debian Bug : 852623 The fix for CVE-2016-8743 in apache2 2.2.22-13+deb7u8 DLA-841-1 caused 852623 in sitesummary, breaking the sitesummary-upload functionality. To address this sitesummary-upload needs to be changed to send CRLF \r\n line endings to be...

Debian DLA-841-2 : apache2 regression update

The fix for CVE-2016-8743 introduced a regression which would segfault apache workers under certain conditions 858373, an issue similar to previously fixed CVE-2015-0253. The issue was introduced in DLA-841-1 and the associated 2.2.22-13+deb7u8 package version. For Debian 7 'Wheezy', these proble...

Debian DSA-3796-1 : apache2 - security update

Several vulnerabilities were discovered in the Apache2 HTTP server. - CVE-2016-0736 RedTeam Pentesting GmbH discovered that modsessioncrypto was vulnerable to padding oracle attacks, which could allow an attacker to guess the session cookie. - CVE-2016-2161 Maksim Malyutin discovered that malicio...

[SECURITY] [DSA 3796-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 26, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3796-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 26, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3796-1 (apache2 - security update)

Several vulnerabilities were discovered in the Apache2 HTTP server. CVE-2016-0736 RedTeam Pentesting GmbH discovered that modsessioncrypto was vulnerable to padding oracle attacks, which could allow an attacker to guess the session cookie. CVE-2016-2161 Maksim Malyutin discovered that malicious...

Apache HTTP Server 2.4.x < 2.4.25 Multiple Vulnerabilities

Binary data 9908.prm...

Medium: httpd24

Issue Overview: The following security-related issues were fixed: Padding oracle vulnerability in Apache modsessioncrypto CVE-2016-0736 DoS vulnerability in modauthdigest CVE-2016-2161 Apache HTTP request parsing whitespace defects CVE-2016-8743 Affected Packages: httpd24 Issue Correction: Run yu...

Apache 2.2.x < 2.2.32 Multiple Vulnerabilities (httpoxy)

According to its banner, the version of Apache running on the remote host is 2.2.x prior to 2.2.32. It is, therefore, affected by the following vulnerabilities : - The Apache HTTP Server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve...

Fedora 25 : httpd (2016-8d9b62c784)

Security fix for CVE-2016-8743, CVE-2016-2161, CVE-2016-0736 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Fedora 24 : httpd (2016-d22f50d985)

Security fix for CVE-2016-8743, CVE-2016-2161, CVE-2016-0736 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Fedora Update for httpd FEDORA-2016-8d9b62c784

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] httpd

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/httpd-2.4.25-i586-1slack14.2.txz: Upgraded. This update fixes the following security issues: CVE-2016-8740: modhttp2:...

CVE-2016-8743

It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a...