CVS commit: pkgsrc

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Nov  1 18:03:04 UTC 2010

Modified Files:
        pkgsrc/devel/apr0: Makefile distinfo
        pkgsrc/devel/apr0/patches: patch-ao patch-au
        pkgsrc/www/apache2: Makefile Makefile.common PLIST buildlink3.mk
            distinfo options.mk
        pkgsrc/www/apache2/patches: patch-ab patch-ac patch-ae patch-ah
Removed Files:
        pkgsrc/devel/apr0/patches: patch-ab patch-ac
        pkgsrc/www/apache2/patches: patch-ap patch-aq

Log Message:
Changes 2.0.64:
* SECURITY: CVE-2010-1452 (cve.mitre.org)
  mod_dav: Fix Handling of requests without a path segment.
* SECURITY: CVE-2009-1891 (cve.mitre.org)
  Fix a potential Denial-of-Service attack against mod_deflate or other
  modules, by forcing the server to consume CPU time in compressing a
  large file after a client disconnects.
* SECURITY: CVE-2009-3095 (cve.mitre.org)
  mod_proxy_ftp: sanity check authn credentials.
* SECURITY: CVE-2009-3094 (cve.mitre.org)
  mod_proxy_ftp: NULL pointer dereference on error paths.
* SECURITY: CVE-2009-3555 (cve.mitre.org)
  mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection
  attack when compiled against OpenSSL version 0.9.8m or later. Introduces
  the 'SSLInsecureRenegotiation' directive to reopen this vulnerability
  and offer unsafe legacy renegotiation with clients which do not yet
  support the new secure renegotiation protocol, RFC 5746.
* SECURITY: CVE-2009-3555 (cve.mitre.org)
  mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
  for OpenSSL versions prior to 0.9.8l; reject any client-initiated
  renegotiations. Forcibly disable keepalive for the connection if there
  is any buffered data readable. Any configuration which requires
  renegotiation for per-directory/location access control is still
  vulnerable, unless using openssl 0.9.8l or later.
* SECURITY: CVE-2010-0434 (cve.mitre.org)
  Ensure each subrequest has a shallow copy of headers_in so that the
  parent request headers are not corrupted.  Elimiates a problematic
  optimization in the case of no request body.
* SECURITY: CVE-2008-2364 (cve.mitre.org)
  mod_proxy_http: Better handling of excessive interim responses
  from origin server to prevent potential denial of service and high
  memory usage.
* SECURITY: CVE-2010-0425 (cve.mitre.org)
  mod_isapi: Do not unload an isapi .dll module until the request
  processing is completed, avoiding orphaned callback pointers.
* SECURITY: CVE-2008-2939 (cve.mitre.org)
  mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
  the FTP URL. Discovered by Marc Bevand of Rapid7.
* Fix recursive ErrorDocument handling.
* mod_ssl: Do not do overlapping memcpy.
* Add Set-Cookie and Set-Cookie2 to the list of headers allowed to pass
  through on a 304 response.
* apxs: Fix -A and -a options to ignore whitespace in httpd.conf


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 pkgsrc/devel/apr0/Makefile
cvs rdiff -u -r1.4 -r1.5 pkgsrc/devel/apr0/distinfo
cvs rdiff -u -r1.1 -r0 pkgsrc/devel/apr0/patches/patch-ab \
    pkgsrc/devel/apr0/patches/patch-ac
cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/devel/apr0/patches/patch-ao \
    pkgsrc/devel/apr0/patches/patch-au
cvs rdiff -u -r1.133 -r1.134 pkgsrc/www/apache2/Makefile
cvs rdiff -u -r1.26 -r1.27 pkgsrc/www/apache2/Makefile.common
cvs rdiff -u -r1.38 -r1.39 pkgsrc/www/apache2/PLIST
cvs rdiff -u -r1.29 -r1.30 pkgsrc/www/apache2/buildlink3.mk
cvs rdiff -u -r1.56 -r1.57 pkgsrc/www/apache2/distinfo
cvs rdiff -u -r1.8 -r1.9 pkgsrc/www/apache2/options.mk
cvs rdiff -u -r1.6 -r1.7 pkgsrc/www/apache2/patches/patch-ab
cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/apache2/patches/patch-ac
cvs rdiff -u -r1.9 -r1.10 pkgsrc/www/apache2/patches/patch-ae
cvs rdiff -u -r1.10 -r1.11 pkgsrc/www/apache2/patches/patch-ah
cvs rdiff -u -r1.5 -r0 pkgsrc/www/apache2/patches/patch-ap \
    pkgsrc/www/apache2/patches/patch-aq

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.