GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Sun Jun 24, 2012 4:26 pm Post subject: [ GLSA 201206-25 ] Apache HTTP Server: Multiple vulnerabilit |
|
|
Gentoo Linux Security Advisory
Title: Apache HTTP Server: Multiple vulnerabilities (GLSA 201206-25)
Severity: high
Exploitable: local, remote
Date: June 24, 2012
Bug(s): #308049, #330195, #380475, #382971, #385859, #389353, #392189, #398761, #401081, #412481
ID: 201206-25
Synopsis
Multiple vulnerabilities were found in Apache HTTP Server.
Background
Apache HTTP Server is one of the most popular web servers on the
Internet.
Affected Packages
Package: www-servers/apache
Vulnerable: < 2.2.22-r1
Unaffected: >= 2.2.22-r1
Architectures: All supported architectures
Description
Multiple vulnerabilities have been discovered in Apache HTTP Server.
Please review the CVE identifiers referenced below for details.
Impact
A remote attacker might obtain sensitive information, gain privileges,
send requests to unintended servers behind proxies, bypass certain
security restrictions, obtain the values of HTTPOnly cookies, or cause a
Denial of Service in various ways.
A local attacker could gain escalated privileges.
Workaround
There is no known workaround at this time.
Resolution
All Apache HTTP Server users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.22-r1"
|
References
CVE-2010-0408
CVE-2010-0434
CVE-2010-1452
CVE-2010-2791
CVE-2011-3192
CVE-2011-3348
CVE-2011-3368
CVE-2011-3607
CVE-2011-4317
CVE-2012-0021
CVE-2012-0031
CVE-2012-0053
CVE-2012-0883 |
|