-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  httpd (SSA:2015-111-03)

New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix security issues.


Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/httpd-2.4.12-i486-1_slack14.1.txz:  Upgraded.
  This update fixes the following security issues:
   * CVE-2014-3583 mod_proxy_fcgi:  Fix a potential crash due to buffer
     over-read, with response headers' size above 8K.
   * CVE-2014-3581 mod_cache:  Avoid a crash when Content-Type has an
     empty value.  PR 56924.
   * CVE-2014-8109 mod_lua:  Fix handling of the Require line when a
     LuaAuthzProvider is used in multiple Require directives with
     different arguments.  PR57204.
   * CVE-2013-5704 core:  HTTP trailers could be used to replace HTTP
     headers late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified request
     headers earlier.  Adds "MergeTrailers" directive to restore legacy
     behavior.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3583
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3581
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8109
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.29-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.29-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.29-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.29-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.29-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.29-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.12-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.12-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.12-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.12-i486-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.12-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
511973e7033d924fe8f2dfac870cfc9d  httpd-2.2.29-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
5fb45ffc524b4afc2b6e3c322bd43ff2  httpd-2.2.29-x86_64-1_slack13.0.txz

Slackware 13.1 package:
47ef44a58d821fe2462817bd308e4c88  httpd-2.2.29-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
4e99389080c31b12a863d315f17e0897  httpd-2.2.29-x86_64-1_slack13.1.txz

Slackware 13.37 package:
9ecaeefcc21871e101c4e41487879ba7  httpd-2.2.29-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
4c4badc191f0c2337d0f05fe4f5f6701  httpd-2.2.29-x86_64-1_slack13.37.txz

Slackware 14.0 package:
44ee311cec11c0b8b5361871f076060a  httpd-2.4.12-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
d222d77977fea4f3d2583398070e70fe  httpd-2.4.12-x86_64-1_slack14.0.txz

Slackware 14.1 package:
d65e3a24abd582fb54b6da0ba926106e  httpd-2.4.12-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
e655bdd8f6f7e13da6ae2c70f9c9eea0  httpd-2.4.12-x86_64-1_slack14.1.txz

Slackware -current package:
bfd8439df17a91bf8b3351a9fdafbfc9  n/httpd-2.4.12-i486-1.txz

Slackware x86_64 -current package:
3c68dceffdf6de2c67ac2b40fc3846dc  n/httpd-2.4.12-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg httpd-2.4.12-i486-1_slack14.1.txz

Then, restart Apache httpd:

# /etc/rc.d/rc.httpd stop
# /etc/rc.d/rc.httpd start


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlU2zZYACgkQakRjwEAQIjN+CwCeOR3KbwIrWH4zXhOaY0AP2MRE
onYAni5MrGCwLn9VQW9vJx5kjKbLUl2+
=WJhl
-----END PGP SIGNATURE-----