Chapter 4. Security Fixes

This update includes fixes for the following security related issues:

Expand

ID	Impact	Summary
CVE-2017-10140	Moderate	libdb: Reads DB_CONFIG from the current working directory
CVE-2017-15710	Low	httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values
CVE-2017-15715	Low	httpd: bypass with a trailing newline in the file name
CVE-2018-0739	Moderate	openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service
CVE-2018-1283	Moderate	httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications
CVE-2018-1301	Low	httpd: Out of bounds access after failure in reading the HTTP request
CVE-2018-1302	Low	httpd: Use-after-free on HTTP/2 stream shutdown
CVE-2018-1303	Moderate	httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS
CVE-2018-1312	Low	httpd: Weak Digest auth nonce generation in mod_auth_digest
CVE-2018-1333	Moderate	httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS
CVE-2018-11759	Important	mod_jk: connector path traversal due to mishandled HTTP requests in httpd
CVE-2018-11763	Moderate	httpd: DoS for HTTP/2 connections by continuous SETTINGS frames
CVE-2018-1000168	Moderate	nghttp2: Null pointer dereference when too large ALTSVC frame is received