[no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=pkgsrc_2008Q2 2008-02-23T05:26:01Z 2008-02-23T05:26:01Z obache obache 2008-02-23T05:26:01Z urn:sha1:159560d80e1fa5794ccf7b9644ad38642a485564 2008-02-23T05:16:33Z obache obache 2008-02-23T05:16:33Z urn:sha1:7828a6f31f52da89af1238288b9b0b0c8b1a5f41 Changes with Apache 1.3.41 *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox] Changes with Apache 1.3.40 (not released) *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imap: Fix cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) SECURITY: CVE-2007-3847 (cve.mitre.org) mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. With Apache 1.3, the denial of service vulnerability applies only to the Windows and NetWare platforms. [Jeff Trawick] *) More efficient implementation of the CVE-2007-3304 PID table patch. This fixes issues with excessive memory usage by the parent process if long-running and with a high number of child process forks during that timeframe. Also fixes bogus "Bad pid" errors. [Jim Jagielski, Jeff Trawick] Changes with Apache 1.3.39 *) SECURITY: CVE-2006-5752 (cve.mitre.org) mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser. [Joe Orton] *) SECURITY: CVE-2007-3304 (cve.mitre.org) Ensure that the parent process cannot be forced to kill non-child processes by checking scoreboard PID data with parent process privately stored PID data. [Jim Jagielski] *) mime.types: Many updates to sync with IANA registry and common unregistered types that the owners refuse to register. Admins are encouraged to update their installed mime.types file. pr: 35550, 37798, 39317, 31483 [Roy T. Fielding] There was no Apache 1.3.38 2008-02-17T20:15:07Z tnn tnn 2008-02-17T20:15:07Z urn:sha1:cf282fd724a01bd60f338b1ca47812aa41c2294a 2008-02-03T14:07:40Z tnn tnn 2008-02-03T14:07:40Z urn:sha1:67a7925cf1f914d6175d3393215f17204e0351f0 2008-02-03T13:24:22Z tnn tnn 2008-02-03T13:24:22Z urn:sha1:dc9c50544b337831d5f80e7eb778f0ef7e0034c7 2008-01-20T04:06:03Z reed reed 2008-01-20T04:06:03Z urn:sha1:aec3fddd1d98bafa2468a7f878a16146b1ac4b99 (As discussed in September 2007 on tech-pkg.) 2007-10-07T20:49:57Z dmcmahill dmcmahill 2007-10-07T20:49:57Z urn:sha1:00bf85083768ab210d8f8f5db3d824f66f472683 This fixes a long standing build failure on SunOS-5.9/sparc and does not seem to break things on NetBSD. 2007-07-04T20:54:31Z jlam jlam 2007-07-04T20:54:31Z urn:sha1:45233ac07a4c6f9e80f4f9350cbb54ee23d8bd54 the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS. 2007-06-28T00:38:00Z lkundrak lkundrak 2007-06-28T00:38:00Z urn:sha1:9062e6bff2964bf33f5a72f5a632ba48b8992063 CVE-2006-5752 XSS in mod_status with ExtendedStatus on CVE-2007-3304 Remote DoS if MPM and mod_cache enabled bumping PKGREVISION 2007-01-23T15:45:43Z ghen ghen 2007-01-23T15:45:43Z urn:sha1:aee9ee5002bf7575264ba27628214eee04512a87 apache, apache2 and apache22.