| Beschreibung: | Description:
The remote host is missing an update to apr-util
announced via advisory FEDORA-2009-5969.
Update Information:
Update to upstream version 1.3.7, see:
http://svn.apache.org/repos/asf/apr/apr-util/tags/1.3.7/CHANGES
Security fixes:
- CVE-2009-0023 Fix underflow in apr_strmatch_precompile.
- CVE-2009-1955 Fix a denial of service attack against the
apr_xml_* interface using the billion laughs entity expansion technique.
- CVE-2009-1956 Fix off by one overflow in apr_brigade_vprintf.
Note: CVE-2009-1956 is only an issue on big-endian architectures.
ChangeLog:
* Mon Jun 8 2009 Bojan Smojver - 1.3.7-1
- bump up to 1.3.7
- CVE-2009-0023
- billion laughs fix of apr_xml_* interface
References:
[ 1 ] Bug #504555 - CVE-2009-1955 apr-util billion laughs attack
https://bugzilla.redhat.com/show_bug.cgi?id=504555
[ 2 ] Bug #504390 - CVE-2009-1956 apr-util single NULL byte buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=504390
[ 3 ] Bug #503928 - CVE-2009-0023 apr-util heap buffer underwrite
https://bugzilla.redhat.com/show_bug.cgi?id=503928
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update apr-util' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2009-5969
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
