-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] httpd (SSA:2015-111-03) New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/httpd-2.4.12-i486-1_slack14.1.txz: Upgraded. This update fixes the following security issues: * CVE-2014-3583 mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with response headers' size above 8K. * CVE-2014-3581 mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924. * CVE-2014-8109 mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments. PR57204. * CVE-2013-5704 core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3583 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3581 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8109 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.29-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.29-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.29-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.29-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.29-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.29-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.12-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.12-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.12-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.12-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.12-x86_64-1.txz MD5 signatures: +-------------+ Slackware 13.0 package: 511973e7033d924fe8f2dfac870cfc9d httpd-2.2.29-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 5fb45ffc524b4afc2b6e3c322bd43ff2 httpd-2.2.29-x86_64-1_slack13.0.txz Slackware 13.1 package: 47ef44a58d821fe2462817bd308e4c88 httpd-2.2.29-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 4e99389080c31b12a863d315f17e0897 httpd-2.2.29-x86_64-1_slack13.1.txz Slackware 13.37 package: 9ecaeefcc21871e101c4e41487879ba7 httpd-2.2.29-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 4c4badc191f0c2337d0f05fe4f5f6701 httpd-2.2.29-x86_64-1_slack13.37.txz Slackware 14.0 package: 44ee311cec11c0b8b5361871f076060a httpd-2.4.12-i486-1_slack14.0.txz Slackware x86_64 14.0 package: d222d77977fea4f3d2583398070e70fe httpd-2.4.12-x86_64-1_slack14.0.txz Slackware 14.1 package: d65e3a24abd582fb54b6da0ba926106e httpd-2.4.12-i486-1_slack14.1.txz Slackware x86_64 14.1 package: e655bdd8f6f7e13da6ae2c70f9c9eea0 httpd-2.4.12-x86_64-1_slack14.1.txz Slackware -current package: bfd8439df17a91bf8b3351a9fdafbfc9 n/httpd-2.4.12-i486-1.txz Slackware x86_64 -current package: 3c68dceffdf6de2c67ac2b40fc3846dc n/httpd-2.4.12-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.4.12-i486-1_slack14.1.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlU2zZYACgkQakRjwEAQIjN+CwCeOR3KbwIrWH4zXhOaY0AP2MRE onYAni5MrGCwLn9VQW9vJx5kjKbLUl2+ =WJhl -----END PGP SIGNATURE-----