-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Fri, 13 Nov 2009 16:06:22 +0100 Source: apache2 Binary: apache2-utils apache2-prefork-dev apache2 apache2-mpm-prefork apache2-doc apache2-mpm-event apache2.2-common apache2-mpm-worker apache2-src apache2-threaded-dev apache2-mpm-perchild Architecture: mips Version: 2.2.3-4+etch11 Distribution: oldstable-security Urgency: high Maintainer: Debian Build Daemon Changed-By: Stefan Fritsch Description: apache2-mpm-event - Event driven model for Apache HTTPD 2.1 apache2-mpm-prefork - Traditional model for Apache HTTPD 2.1 apache2-mpm-worker - High speed threaded model for Apache HTTPD 2.1 apache2-prefork-dev - development headers for apache2 apache2-threaded-dev - development headers for apache2 apache2-utils - utility programs for webservers apache2.2-common - Next generation, scalable, extendable web server Changes: apache2 (2.2.3-4+etch11) oldstable-security; urgency=high . * Security: - Reject any client-initiated SSL/TLS renegotiations. This is a partial fix for the TLS renegotiation prefix injection attack (CVE-2009-3555). Any configuration which requires renegotiation for per-directory/location access control or uses "SSLVerifyClient optional" is still vulnerable. - Fix DoS by malicious ftp server (CVE-2009-3094) - Fix missing input sanitization: a user could execute arbitrary ftp commands on the backend ftp server (CVE-2009-3095) Files: 68a93c433a24dd42b461907c2b61c6d2 951736 web optional apache2.2-common_2.2.3-4+etch11_mips.deb 791a223b58a6a3a00fdd5517decc6ff2 434122 web optional apache2-mpm-worker_2.2.3-4+etch11_mips.deb 01c3cf5fc888bff3967c95736b3caf40 430112 web optional apache2-mpm-prefork_2.2.3-4+etch11_mips.deb 2d07f9376a7c7eb6229e0c5238e604fc 434784 web optional apache2-mpm-event_2.2.3-4+etch11_mips.deb ab3498abf9ddc41f0665be9c2912beab 350066 web optional apache2-utils_2.2.3-4+etch11_mips.deb 10cf7a6fa3ad60183a80b7fddc08ed98 407022 devel optional apache2-prefork-dev_2.2.3-4+etch11_mips.deb 688656128f0f46e8b35da61d731e244f 407674 devel optional apache2-threaded-dev_2.2.3-4+etch11_mips.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQFK/oejbxelr8HyTqQRAjHJAKCLxJJq63iCMIYzpxrz7wi8RQEmNgCgvNGA g3u5HOtfy5R2HOIujRlq390= =eVhV -----END PGP SIGNATURE-----