* SECURITY UPDATE: bypass multipart filtering using invalid quoting
(LP: #1016909)
- debian/patches/CVE-2012-2751: Fix detection of invalid
quotes. Thanks to Alberto Gonzalez Iniesta for the backported patch
- Patch taken from Oneiric package
- CVE-2012-2751
* SECURITY UPDATE: disclosure of local files or denial of service by
resource exhaustion via XML External Entity (XEE) attacks
(LP: #1169030)
- debian/patches/CVE-2013-1915.patch: Add an option to allow loading
external entities (disabled by default). Backported from upstream
patch
- d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe
- CVE-2013-1915
-- Evan Broder <email address hidden> Tue, 16 Apr 2013 09:05:37 -0700
This bug was fixed in the package libapache- mod-security - 2.5.11-1ubuntu0.1
--------------- mod-security (2.5.11-1ubuntu0.1) lucid-security; urgency=low
libapache-
* SECURITY UPDATE: bypass multipart filtering using invalid quoting patches/ CVE-2012- 2751: Fix detection of invalid patches/ CVE-2013- 1915.patch: Add an option to allow loading b26e3c61b04d16e 8ca5de76fe
(LP: #1016909)
- debian/
quotes. Thanks to Alberto Gonzalez Iniesta for the backported patch
- Patch taken from Oneiric package
- CVE-2012-2751
* SECURITY UPDATE: disclosure of local files or denial of service by
resource exhaustion via XML External Entity (XEE) attacks
(LP: #1169030)
- debian/
external entities (disabled by default). Backported from upstream
patch
- d4d80b38aa85ecc
- CVE-2013-1915
-- Evan Broder <email address hidden> Tue, 16 Apr 2013 09:05:37 -0700