apache2 2.0.55-4ubuntu2.9 source package in Ubuntu

Changelog

apache2 (2.0.55-4ubuntu2.9) dapper-security; urgency=low

  * SECURITY UPDATE: Reject client-initiated SSL/TLS renegotiations.
    Partial fix for CVE-2009-3555. Configurations requiring renegotiation
    of per-directory/location access controls are still affected until
    OpenSSL is updated.
    - debian/patches/115_CVE-2009-3555.patch: disable all client
      renegotiations
    - based on http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch
    - CVE-2009-3555
  * SECURITY UPDATE: fix NULL pointer dereference in mod_proxy_ftp module
    - debian/patches/116-CVE-2009-3094.patch: fix NULL pointer dereference
      in mod_proxy_ftp.c/apr_socket_close() and potential buffer overread
      in EPSV response parser
    - based on http://svn.apache.org/viewvc?revision=814652&view=revision
    - CVE-2009-3094
  * SECURITY UPDATE: fix access control bypass in mod_proxy_ftp when
    configured as a reverse proxy
    - debian/patches/117-CVE-2009-3095.patch: adjust proxy_ftp_handler()
      in mod_proxy_ftp.c to fail if the decoded Basic credentials contain
      special characters.
    - based on http://svn.apache.org/viewvc?revision=814045&view=revision
    - CVE-2009-3095
 -- Jamie Strandboge <email address hidden>   Thu, 12 Nov 2009 15:45:14 -0600