Bug 274193

Summary:	<dev-libs/apr-util-1.3.5 DoS (CVE-2009-0023)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	apache-bugs
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=503928
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	272260
Bug Blocks:

Description Alex Legler (RETIRED) archtester

2009-06-15 06:17:07 UTC

CVE-2009-0023 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0023):
  The apr_strmatch_precompile function in strmatch/apr_strmatch.c in
  Apache APR-util before 1.3.5 allows remote attackers to cause a
  denial of service (daemon crash) via crafted input involving (1) a
  .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI
  directive in the mod_dav_svn module in the Apache HTTP Server, (3)
  the mod_apreq2 module for the Apache HTTP Server, or (4) an
  application that uses the libapreq2 library, related to an "underflow
  flaw."

Comment 1 Alex Legler (RETIRED) archtester

2009-06-26 08:49:11 UTC

GLSA together with bug 272260.

Comment 2 Alex Legler (RETIRED) archtester

2009-07-04 07:49:41 UTC

GLSA 200907-03