openSUSE Security Update: apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0212-1 Rating: moderate References: #722545 #729181 Cross-References: CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges In addition to that the following changes were made: - new template file: /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1 only, browser match stuff commented out. - rc script /etc/init.d/apache2: handle reload with deleted binaries by message to stdout only, but refrain from sending signals. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-5520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.11.1 apache2-devel-2.2.17-4.11.1 apache2-example-certificates-2.2.17-4.11.1 apache2-example-pages-2.2.17-4.11.1 apache2-itk-2.2.17-4.11.1 apache2-prefork-2.2.17-4.11.1 apache2-utils-2.2.17-4.11.1 apache2-worker-2.2.17-4.11.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.11.1 References: http://support.novell.com/security/cve/CVE-2011-3368.html http://support.novell.com/security/cve/CVE-2011-3607.html http://support.novell.com/security/cve/CVE-2011-4317.html https://bugzilla.novell.com/722545 https://bugzilla.novell.com/729181