Commit e91be0f2 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

SECURITY: CVE-2012-0031 (cve.mitre.org) 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@1392043 13f79535-47bb-0310-9956-ffa450edef68
parent 5b03afca

CHANGES

+5 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.65



  *) SECURITY: CVE-2012-0031 (cve.mitre.org)

     Fix scoreboard issue which could allow an unprivileged child process 

     could cause the parent to crash at shutdown rather than terminate 

     cleanly.  [Joe Orton]



  *) SECURITY: CVE-2011-3607 (cve.mitre.org)

     core: Fix integer overflow in ap_pregsub. This can be triggered e.g.

     with mod_setenvif via a malicious .htaccess. [Stefan Fritsch]

STATUS

+0 −9
Original line number Diff line number Diff line
@@ -171,15 +171,6 @@ RELEASE SHOWSTOPPERS: 
        http://people.apache.org/~trawick/2.0-CVE-2011-4317-r1235443.patch

       +1: trawick



  *) SECURITY: CVE-2012-0031 (cve.mitre.org)

     Fix scoreboard issue which could allow an unprivileged child process 

     could cause the parent to crash at shutdown rather than terminate 

     cleanly.  [Joe Orton]



     r1231058 on 2.0.x:

       http://people.apache.org/~trawick/2.0-CVE-2012-0031-r1231058.patch

     +1: trawick, wrowe, rjung



  *) SECURITY: CVE-2012-0053 (cve.mitre.org)

     Fix an issue in error responses that could expose "httpOnly" cookies

     when no custom ErrorDocument is specified for status code 400.

server/scoreboard.c

+4 −2
Original line number Diff line number Diff line
@@ -41,6 +41,8 @@ AP_DECLARE_DATA scoreboard *ap_scoreboard_image = NULL; 
AP_DECLARE_DATA const char *ap_scoreboard_fname = NULL;

AP_DECLARE_DATA int ap_extended_status = 0;



static ap_scoreboard_e scoreboard_type;



#if APR_HAS_SHARED_MEMORY



#include "apr_shm.h"
@@ -230,7 +232,7 @@ apr_status_t ap_cleanup_scoreboard(void *d) 
    if (ap_scoreboard_image == NULL) {

        return APR_SUCCESS;

    }

    if (ap_scoreboard_image->global->sb_type == SB_SHARED) {

    if (scoreboard_type == SB_SHARED) {

        ap_cleanup_shared_mem(NULL);

    }

    else {
@@ -289,7 +291,7 @@ int ap_create_scoreboard(apr_pool_t *p, ap_scoreboard_e sb_type) 
        ap_init_scoreboard(sb_mem);

    }



    ap_scoreboard_image->global->sb_type = sb_type;

    ap_scoreboard_image->global->sb_type = scoreboard_type = sb_type;

    ap_scoreboard_image->global->running_generation = running_gen;

    ap_scoreboard_image->global->restart_time = apr_time_now();