Withdrawn by the publisher.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

A vulnerability (CVE-2016-8743) exists in Cosminexus HTTP Server and Hitachi Web Server.

httpd: Padding Oracle in Apache mod_session_crypto httpd: DoS vulnerability in mod_auth_digest httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir httpd: Apache HTTP Request Parsing Whitespace Defects

httpd: Padding Oracle in Apache mod_session_crypto httpd: mod_http2 denial-of-service by thread starvation httpd: DoS vulnerability in mod_auth_digest httpd: Incomplete handling of LimitRequestFields directive in mod_http2 httpd: Apache HTTP Request Parsing Whitespace Defects httpd: IP address spoofing when proxying using mod_remoteip and mod_rewrite

Security update for apache2

Affected: Ubuntu:14.04:LTS: apache2, Ubuntu:16.04:LTS: apache2

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in Apple Mac OS ausnutzen, um Code mit Kernel Privilegien auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Denial of Service Angriff durchzuführen oder vertrauliche Daten einzusehen.