MDVSA-2011:084
- Nom du paquet
- apr
- Date
- 2011-05-13
- Advisory ID
- MDVSA-2011:084
- Affected versions
- 2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.1 i586 , 2010.0 i586 , 2009.0 i586 , CS4.0 i586 , CS4.0 x86_64 , MES5 x86_64 , 2010.1 x86_64
Problem description
It was discovered that the apr_fnmatch() function used an unconstrained
recursion when processing patterns with the '*' wildcard. An attacker
could use this flaw to cause an application using this function,
which also accepted untrusted input as a pattern for matching (such
as an httpd server using the mod_autoindex module), to exhaust all
stack memory or use an excessive amount of CPU time when performing
matching (CVE-2011-0419).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct this issue.
Updated packages
2009.0 x86_64
8d7329923bb5e81dbca4ea1d355e2846 2009.0/x86_64/lib64apr1-1.3.3-2.2mdv2009.0.x86_64.rpm 7838341b9612ac1ab78606a8c2143306 2009.0/x86_64/lib64apr-devel-1.3.3-2.2mdv2009.0.x86_64.rpm 1b7160e3c2178a302c07a6e23d59c82d 2009.0/SRPMS/apr-1.3.3-2.2mdv2009.0.src.rpm
MES5 i586
7e3ca3eb765d21b1366f55c9b9b56027 mes5/i586/libapr1-1.3.3-2.2mdvmes5.2.i586.rpm fbf9421168cb26090b5ff021a2bb823a mes5/i586/libapr-devel-1.3.3-2.2mdvmes5.2.i586.rpm f7afcb8a3dd0ecca2998a32df747afc9 mes5/SRPMS/apr-1.3.3-2.2mdvmes5.2.src.rpm
2010.0 x86_64
d1d1660e4427134fd94eb61c6bf50573 2010.0/x86_64/lib64apr1-1.3.9-1.1mdv2010.0.x86_64.rpm 0c26aa24bf82e860353f5d279f1d7c3d 2010.0/x86_64/lib64apr-devel-1.3.9-1.1mdv2010.0.x86_64.rpm 09656854ddec250000ae8ec2a54db5ac 2010.0/SRPMS/apr-1.3.9-1.1mdv2010.0.src.rpm
2010.1 i586
6bcbd128393e66f857a0237858b8296c 2010.1/i586/libapr1-1.4.2-1.1mdv2010.2.i586.rpm 711375d83f3e8ba475f5e50e9cd72c58 2010.1/i586/libapr-devel-1.4.2-1.1mdv2010.2.i586.rpm 1e79b3cbed82fe6a72a5e363ee6de1ac 2010.1/SRPMS/apr-1.4.2-1.1mdv2010.2.src.rpm
2010.0 i586
50d349a278f9fb9ddae7fe78b9c7cfb5 2010.0/i586/libapr1-1.3.9-1.1mdv2010.0.i586.rpm a2ab8bacb929689515885f8f6b55e20b 2010.0/i586/libapr-devel-1.3.9-1.1mdv2010.0.i586.rpm 09656854ddec250000ae8ec2a54db5ac 2010.0/SRPMS/apr-1.3.9-1.1mdv2010.0.src.rpm
2009.0 i586
be64584ff33e8b302b98371cc2250737 2009.0/i586/libapr1-1.3.3-2.2mdv2009.0.i586.rpm f7dc54c6193e0ca7f3a24606e9d7a418 2009.0/i586/libapr-devel-1.3.3-2.2mdv2009.0.i586.rpm 1b7160e3c2178a302c07a6e23d59c82d 2009.0/SRPMS/apr-1.3.3-2.2mdv2009.0.src.rpm
CS4.0 i586
14e8e64d57936ac0d07614bd67446f03 corporate/4.0/i586/libapr1-1.2.7-1.2.20060mlcs4.i586.rpm ce54af727421b84a6b44e1e93c026d2e corporate/4.0/i586/libapr1-devel-1.2.7-1.2.20060mlcs4.i586.rpm b32595e78258a491a42ca109d6bceba2 corporate/4.0/SRPMS/apr-1.2.7-1.2.20060mlcs4.src.rpm
CS4.0 x86_64
8d384c32df7462ea43898d5747a8896e corporate/4.0/x86_64/lib64apr1-1.2.7-1.2.20060mlcs4.x86_64.rpm ceb813bb8fbcd8047c4bb8938bdef32b corporate/4.0/x86_64/lib64apr1-devel-1.2.7-1.2.20060mlcs4.x86_64.rpm b32595e78258a491a42ca109d6bceba2 corporate/4.0/SRPMS/apr-1.2.7-1.2.20060mlcs4.src.rpm
MES5 x86_64
418475e740da85914275f648045dbacb mes5/x86_64/lib64apr1-1.3.3-2.2mdvmes5.2.x86_64.rpm bc4a3e5372735992d633f5933b540891 mes5/x86_64/lib64apr-devel-1.3.3-2.2mdvmes5.2.x86_64.rpm f7afcb8a3dd0ecca2998a32df747afc9 mes5/SRPMS/apr-1.3.3-2.2mdvmes5.2.src.rpm
2010.1 x86_64
10e549216a50287a8b00ceabc989f582 2010.1/x86_64/lib64apr1-1.4.2-1.1mdv2010.2.x86_64.rpm dcb20d2f8c1698ad7da97d8cfad775bc 2010.1/x86_64/lib64apr-devel-1.4.2-1.1mdv2010.2.x86_64.rpm 1e79b3cbed82fe6a72a5e363ee6de1ac 2010.1/SRPMS/apr-1.4.2-1.1mdv2010.2.src.rpm