~ubuntu-branches/ubuntu/karmic/apache2/karmic-security : changes

~ubuntu-branches/ubuntu/karmic/apache2/karmic-security » Changes to debian/apache2.2-common.dirs from revision 54

From Revision 54

Rev	Summary	Authors	Tags	Date
36	* add ufw integration (see * add ufw integration (see https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages) (LP: #261198) - debian/control: suggest ufw for apache2.2-common - add apache2.2-common.ufw.profile with 3 profiles and install it to /etc/ufw/applications.d/apache2.2-common	Didier Roche	2.2.9-3ubuntu2	15 years ago
26	* New upstream version: * New upstream version: - Fixes cross-site scripting issues in o mod_imagemap (CVE-2007-5000) o mod_status (CVE-2007-6388) o mod_proxy_balancer's balancer manager (CVE-2007-6421) - Fixes a denial of service issue in mod_proxy_balancer's balancer manager (CVE-2007-6422). - Fixes mod_proxy URL encoding in error messages (closes: #337325). - Adds explicit charset to the output of various modules to work around possible cross-site scripting flaws affecting web browsers that do not derive the response character set as required by RFC2616. For mod_proxy_ftp there is now the new ProxyFtpDirCharset directive to specify something else than ISO-8859-1 (CVE-2008-0005). - Adds mod_substitute which performs inline response content pattern matching (including regex) and substitution (like mod_line_edit). - Adds "DefaultType none" option. - Adds new "B" option to RewriteRule to suppress URL unescaping. - Adds an "if" directive for mod_include to test whether an URL is accessible, and if so, conditionally display content. - Adds support for mod_ssl to the event MPM. * Move the configuration of User, Group, and PidFile to /etc/apache2/envvars. This makes it easier to use these settings in scripts. /etc/apache2/envvars can now also be used to influence apache2ctl (inspired by Marc Haber's patch). (Closes: #349709, #460105, #458085) * Make apache2ctl check the configuration syntax before trying to restart apache, to match the behaviour documented in the man page. (Closes: #459236) * Convert docs to be directly viewable with a browser (and not use content negotiation). * Add doc-base entry for the documentation. (closes: #311269) * Don't ship default files in /var/www, but copy a sample file to /var/www/index.html on new installs. Also remove the now unneeded RedirectMatch line from sites-available/default. (Closes: #411774, #458093) * Add some information to README.Debian (Apache wiki, default virtual host) * Build with LDFLAGS=-Wl,--as-needed to drop a lot of unnecessary dependencies, easing library transitions (closes: #458857). * Add icons for OpenDocuments, add sharutils to Build-Depends for uudecode. Patch by Nicolas Valcárcel. (Closes: #436441) * Add reportbug script to list enabled modules. * Fix some lintian warnings: - Pass --no-start to dh_installinit instead of omitting the debhelper token in various maintainer scripts. Also move the update-rc.d call to apache2.2-common. - Add Short-Description to init script. * Remove unused apache2-mpm-prefork.prerm from source package and clean up debian/rules a bit. * Don't ship NEWS.Debian with apache2-utils, as the contents are only relevant for the server.	Stefan Fritsch	2.2.8-1	16 years ago
16	[ Stefan Fritsch ] [ Stefan Fritsch ] * Urgency medium for security fix * Fix CVE-2007-1863: DoS in mod_cache * New upstream version (Closes: #427050) - Fixes "proxy: error reading status line from remote server" (Closes: #410331) * Fix CVE-2007-1862: mod_mem_cache DoS (introduced in 2.2.4) * Change logrotate script to use reload instead of restart. (Closes: #298689) * chmod o-rx /var/log/apache2 (Closes: #291841) * chmod o-x suexec (Closes: #431048) * Update patch for truncated mod_cgi 500 responses from upstream SVN (Closes: #412580) * Don't use AddDefaultCharset for our docs (Closes: #414429) * fix options syntax in sites-available/default (Closes: #419539) * Move conf.d include to the end of apache2.conf (Closes: #305933) * Remove log, cache, and lock files on purge (Closes: #428887) * Ship /usr/lib/cgi-bin (Closes: #415698) * Add note to README.Debian how to read docs (Closes: #350822) * Document pid file name (Closes: #350286) * Update Standards-Version (no changes needed) * Fix some lintian warnings, add some overrides * Start apache when doing a "restart" even if it was not running (Closes: #384682) * reload config in apache2-doc postinst (Closes: #289289) * don't fail in prerm if apache is not running (Closes: #418536) * Suggest apache2-doc and www-browser (Closes: #399056) * Make init script always display a warning if NO_START=1 since VERBOSE=yes is not the default anymore (Closes: #430116) * Replace apache2(8) man page with a more current version * Add httxt2dbm(8) man page * Show -X option in help message (Closes: #391817) * remove sick-hack-to-update-modules * don't depend on procps on hurd (Closes: #431125) [ Peter Samuelson ] * Add shlibs:Depends to apache2.2-common.	Stefan Fritsch	2.2.4-1	16 years ago
15	[ Tollef Fog Heen ] [ Tollef Fog Heen ] * Fix up apache2-src so the .tar.gz contains an apache2 top level directory. * Make apache2 MPMs provide and conflict with apache2-mpm so other packages can provide MPMs too. * Get rid of 2.1 references from descriptions. (Closes: #400981) [ Thom May ] * Let the init script cope with multiple pid files correctly. Probably we shouldn't be doing this at all, but we might as well do it properly! (Closes: #396162) * Add a sensible autoindex default config * Add patch from upstream to ensure that mod_cgi 500 responses aren't truncated (Closes: #412580) * Use graceful-stop to shutdown apache to ensure we cope nicely with long running or blocked children [ Peter Samuelson ] * Ship apache2 manpage in apache2.2-common. (Closes: #391813) * Rearrange init script so that 'force-reload' is the same as 'reload'. (Closes: #401053) * Add Build-Depends: mawk. (Closes: #403682) * Add a needed <IfModule mod_include.c> guard to apache2.conf. (Closes: #407307) * Stop shipping /var/run/apache2/ as it is created at runtime anyway. * Move the /var/lock/apache2 owner fix from the apache2.2-common postinst to the init script, as /var/lock may not persist across reboots. (Closes: #420101) [ Stefan Fritsch ] * Add Build-Depends: libssl-dev, zlib1g-dev (Closes: #399043) * Add XS-Vcs-* to debian/control * Improve handling of empty $MODNAME in a2enmod (Closes: #422589) * Treat apache2-mpm-itk as prefork in a2enmod (Closes: #412602) * Re-add README.Debian and describe - the config dir layout (closes: #419552) - which files are ignored by Include - when and how to change "restart" to "reload" in the logrotate script * When purging, remove {mods,sites}-enabled symlinks and the config files created by postinst (Closes: #397789) * Fix suexec to log after a cgi error (Closes: #312385) * Add watch file * Add AddType for .bz2 (Closes: #416322) * Make init script messages conform better to policy (Closes: #390348) and exit with failure if called with unknown parameter (Closes: #412407) * Fix segfault in mod_proxy_ftp when FTP server sends back no spaces (Closes: #413727) * Ship /etc/apache2/conf.d/apache2-doc (Closes: #418464) * Tell the user when selecting cgid instead of cgi (Closes: #428058) * Add a2ensite/a2dissite man pages (Closes: #322385) * Comment out CacheEnable by default, to prevent filling up /var. Document the problem in README.Debian and NEWS.Debian, point to htcacheclean and give a warning when doing a2enmod disk_cache (Closes: #423653). * Add myself to Uploaders.	Stefan Fritsch	2.2.3-5	17 years ago
12	* Non-maintainer upload. * Non-maintainer upload. * 043_ajp_connection_reuse: Patch from upstream Bugzilla, fixing a critical issue with regard to connection reuse in mod_proxy_ajp. Closes: #396265	Andreas Barth	2.2.3-3.2	17 years ago