SuSE: 2012:0323-1: important: Apache2
Summary
This update of apache fixes regressions and several
security problems:
*
bnc#741243, CVE-2012-0031: Fixed a scoreboard
corruption (shared mem segment) by child causes crash of
privileged parent (invalid free()) during shutdown.
*
bnc#743743,CVE-2012-0053: Fixed an issue in error
responses that could expose "httpOnly" cookies when no
custom ErrorDocument is specified for status code 400".
*
bnc#736706, the SSL configuration template suggested
weak ciphers
*
bnc#738855,CVE-2007-6750: The "mod_reqtimeout" module
was backported from Apache 2.2.21 to help mitigate the
"Slowloris" Denial of Service attack.
You need to enable the "mod_reqtimeout" module in
your existing apache configuration to make it effective,
e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2.
Security Issue references:
* CVE-2012-0031
References
#736706 #738855 #741243 #743743
Cross- CVE-2007-6750 CVE-2012-0031 CVE-2012-0053
Affected Products:
SUSE Linux Enterprise Server 10 SP4
SLE SDK 10 SP4
https://www.suse.com/security/cve/CVE-2007-6750.html
https://www.suse.com/security/cve/CVE-2012-0031.html
https://www.suse.com/security/cve/CVE-2012-0053.html
https://bugzilla.novell.com/736706
https://bugzilla.novell.com/738855
https://bugzilla.novell.com/741243
https://bugzilla.novell.com/743743
https://login.microfocus.com/nidp/app/login