> PKGREVISION marked in Makefile.common. > This means bump both apache2 and apr0. > Does it really need to update both packages to fix CVE-2008-2364? Wupps, maybe not. But I guess it would be bad to down-number? Regards, - Håvard