[slackware-security] httpd

New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix security issues.

Here are the details from the Slackware 14.1 ChangeLog:

patches/packages/httpd-2.4.12-i486-1_slack14.1.txz: Upgraded.
This update fixes the following security issues:

• CVE-2014-3583 mod_proxy_fcgi: Fix a potential crash due to buffer
  over-read, with response headers’ size above 8K.
• CVE-2014-3581 mod_cache: Avoid a crash when Content-Type has an
  empty value. PR 56924.
• CVE-2014-8109 mod_lua: Fix handling of the Require line when a
  LuaAuthzProvider is used in multiple Require directives with
  different arguments. PR57204.
• CVE-2013-5704 core: HTTP trailers could be used to replace HTTP
  headers late during request processing, potentially undoing or
  otherwise confusing modules that examined or modified request
  headers earlier. Adds “MergeTrailers” directive to restore legacy
  behavior.
  For more information, see:
  https://vulners.com/cve/CVE-2014-3583
  https://vulners.com/cve/CVE-2014-3581
  https://vulners.com/cve/CVE-2014-8109
  https://vulners.com/cve/CVE-2013-5704
  (* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.29-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.29-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.29-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.29-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.29-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.29-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.12-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.12-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.12-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.12-i486-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.12-x86_64-1.txz

MD5 signatures:

Slackware 13.0 package:
511973e7033d924fe8f2dfac870cfc9d httpd-2.2.29-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
5fb45ffc524b4afc2b6e3c322bd43ff2 httpd-2.2.29-x86_64-1_slack13.0.txz

Slackware 13.1 package:
47ef44a58d821fe2462817bd308e4c88 httpd-2.2.29-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
4e99389080c31b12a863d315f17e0897 httpd-2.2.29-x86_64-1_slack13.1.txz

Slackware 13.37 package:
9ecaeefcc21871e101c4e41487879ba7 httpd-2.2.29-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
4c4badc191f0c2337d0f05fe4f5f6701 httpd-2.2.29-x86_64-1_slack13.37.txz

Slackware 14.0 package:
44ee311cec11c0b8b5361871f076060a httpd-2.4.12-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
d222d77977fea4f3d2583398070e70fe httpd-2.4.12-x86_64-1_slack14.0.txz

Slackware 14.1 package:
d65e3a24abd582fb54b6da0ba926106e httpd-2.4.12-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
e655bdd8f6f7e13da6ae2c70f9c9eea0 httpd-2.4.12-x86_64-1_slack14.1.txz

Slackware -current package:
bfd8439df17a91bf8b3351a9fdafbfc9 n/httpd-2.4.12-i486-1.txz

Slackware x86_64 -current package:
3c68dceffdf6de2c67ac2b40fc3846dc n/httpd-2.4.12-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg httpd-2.4.12-i486-1_slack14.1.txz

Then, restart Apache httpd:

> /etc/rc.d/rc.httpd stop
> /etc/rc.d/rc.httpd start