Commit e38fef52 authored by Eric Covener's avatar Eric Covener
Browse files

Merge r1296428 from trunk: 

Fix insecure handling of LD_LIBRARY_PATH that could lead to the
current working directory to be searched for DSOs

CVE-2012-0883



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1341651 13f79535-47bb-0310-9956-ffa450edef68
parent c95154b7

CHANGES

+4 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.23



  *) SECURITY: CVE-2012-0883 (cve.mitre.org)

     envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the

     current working directory to be searched for DSOs. [Stefan Fritsch]



  *) core: Fix building against PCRE 8.30 by switching from the obsolete

     pcre_info() to pcre_fullinfo(). PR 52623 [Ruediger Pluem, Rainer Jung]

support/envvars-std.in

+5 −1
Original line number Diff line number Diff line
@@ -18,7 +18,11 @@ 
#

# This file is generated from envvars-std.in

#

if test "x$@SHLIBPATH_VAR@" != "x" ; then

  @SHLIBPATH_VAR@="@exp_libdir@:$@SHLIBPATH_VAR@"

else

  @SHLIBPATH_VAR@="@exp_libdir@"

fi

export @SHLIBPATH_VAR@

#

@OS_SPECIFIC_VARS@