Описание
ELSA-2015-0325: httpd security, bug fix, and enhancement update (LOW)
[2.4.6-31.0.1]
- replace index.html with Oracle's index page oracle_index.html
[2.4.6-31]
- mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled instead of hardcoding it (#1168050)
- mod_proxy: support Unix Domain Sockets (#1168081)
[2.4.6-30]
- core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
- mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
[2.4.6-29]
- rebuild against proper version of OpenSSL (#1080125)
[2.4.6-28]
- set vstring based on /etc/os-release (#1114123)
[2.4.6-27]
- fix the dependency on openssl-libs to match the fix for #1080125
[2.4.6-26]
- allow <Auth*ProviderAlias>'es to be seen under virtual hosts (#1131847)
[2.4.6-25]
- do not use hardcoded curve for ECDHE suites (#1080125)
[2.4.6-24]
- allow reverse-proxy to be set via SetHandler (#1136290)
[2.4.6-23]
- fix possible crash in SIGINT handling (#1131006)
[2.4.6-22]
- ab: fix integer overflow when printing stats with lot of requests (#1092420)
[2.4.6-21]
- add pre_htaccess so mpm-itk can be build as separate module (#1059143)
[2.4.6-20]
- mod_ssl: prefer larger keys and support up to 8192-bit keys (#1073078)
Обновленные пакеты
Oracle Linux 7
Oracle Linux x86_64
httpd
2.4.6-31.0.1.el7
httpd-devel
2.4.6-31.0.1.el7
httpd-manual
2.4.6-31.0.1.el7
httpd-tools
2.4.6-31.0.1.el7
mod_ldap
2.4.6-31.0.1.el7
mod_proxy_html
2.4.6-31.0.1.el7
mod_session
2.4.6-31.0.1.el7
mod_ssl
2.4.6-31.0.1.el7
Связанные CVE
Связанные уязвимости
ELSA-2014-1972: httpd24-httpd security and bug fix update (LOW)
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.