Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 274193 - <dev-libs/apr-util-1.3.5 DoS (CVE-2009-0023)
Summary: <dev-libs/apr-util-1.3.5 DoS (CVE-2009-0023)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa]
Keywords:
Depends on: CVE-2009-1955
Blocks:
  Show dependency tree
 
Reported: 2009-06-15 06:17 UTC by Alex Legler (RETIRED)
Modified: 2009-07-04 07:49 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-06-15 06:17:07 UTC
CVE-2009-0023 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0023):
  The apr_strmatch_precompile function in strmatch/apr_strmatch.c in
  Apache APR-util before 1.3.5 allows remote attackers to cause a
  denial of service (daemon crash) via crafted input involving (1) a
  .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI
  directive in the mod_dav_svn module in the Apache HTTP Server, (3)
  the mod_apreq2 module for the Apache HTTP Server, or (4) an
  application that uses the libapreq2 library, related to an "underflow
  flaw."
Comment 1 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-06-26 08:49:11 UTC
GLSA together with bug 272260.
Comment 2 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-07-04 07:49:41 UTC
GLSA 200907-03