Beschreibung: | Description: The remote host is missing an update to apr-util announced via advisory FEDORA-2009-5969.
Update Information:
Update to upstream version 1.3.7, see: http://svn.apache.org/repos/asf/apr/apr-util/tags/1.3.7/CHANGES Security fixes: - CVE-2009-0023 Fix underflow in apr_strmatch_precompile. - CVE-2009-1955 Fix a denial of service attack against the apr_xml_* interface using the billion laughs entity expansion technique. - CVE-2009-1956 Fix off by one overflow in apr_brigade_vprintf. Note: CVE-2009-1956 is only an issue on big-endian architectures.
ChangeLog:
* Mon Jun 8 2009 Bojan Smojver - 1.3.7-1 - bump up to 1.3.7 - CVE-2009-0023 - billion laughs fix of apr_xml_* interface
References:
[ 1 ] Bug #504555 - CVE-2009-1955 apr-util billion laughs attack https://bugzilla.redhat.com/show_bug.cgi?id=504555 [ 2 ] Bug #504390 - CVE-2009-1956 apr-util single NULL byte buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=504390 [ 3 ] Bug #503928 - CVE-2009-0023 apr-util heap buffer underwrite https://bugzilla.redhat.com/show_bug.cgi?id=503928
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use su -c 'yum update apr-util' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2009-5969
CVSS Score: 7.8
CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
|