Module Name:	pkgsrc
Committed By:	tron
Date:		Sun Oct  6 12:50:01 UTC 2002

Modified Files:
	pkgsrc/www/apache6: Makefile PLIST distinfo

Log Message:
Update "apache6" package to version 1.3.27. This version fixes many bugs
discovered in version 1.3.26 including these security fixes:
- SECURITY: CAN-2002-0840 (cve.mitre.org)
  Prevent a cross-site scripting vulnerability in the default
  error page.  The issue could only be exploited if the directive
  UseCanonicalName is set to Off and a server is being run at
  a domain that allows wildcard DNS.  [Matthew Murphy]
- SECURITY CAN-2002-0843 (cve.mitre.org)
  Fix some possible overflows in ab.c that could be exploited by
  a malicious server. Reported by David Wagner. [Jim Jagielski]
- SECURITY CAN-2002-0839 (cve.mitre.org)
  Add the new directive 'ShmemUIDisUser'. By default, Apache
  will no longer set the uid/gid of SysV shared memory scoreboard
  to User/Group, and it will therefore stay the uid/gid of
  the parent Apache process. This is actually the way it should
  be, however, some implementations may still require this, which
  can be enabled by 'ShmemUIDisUser On'.  Reported by iDefense.
  [Jim Jagielski]


To generate a diff of this commit:
cvs rdiff -r1.58 -r1.59 pkgsrc/www/apache6/Makefile
cvs rdiff -r1.4 -r1.5 pkgsrc/www/apache6/PLIST
cvs rdiff -r1.13 -r1.14 pkgsrc/www/apache6/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.