- up to 2.4.25; fixes CVE-2016-8743, CVE-2016-0736, CVE-2016-2161, CVE-2016-5387...

diff --git a/apache-CVE-2016-5387.patch b/apache-CVE-2016-5387.patch
deleted file mode 100644 (file)
index b8e9c14..0000000
--- a/apache-CVE-2016-5387.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/server/util_script.c b/server/util_script.c
-index 5e071a2..443dfb6 100644
---- a/server/util_script.c
-+++ b/server/util_script.c
-@@ -186,6 +186,14 @@ AP_DECLARE(void) ap_add_common_vars(request_rec *r)
-         else if (!ap_cstr_casecmp(hdrs[i].key, "Content-length")) {
-             apr_table_addn(e, "CONTENT_LENGTH", hdrs[i].val);
-         }
-+        /* HTTP_PROXY collides with a popular envvar used to configure
-+         * proxies, don't let clients set/override it.  But, if you must...
-+         */
-+#ifndef SECURITY_HOLE_PASS_PROXY
-+        else if (!ap_cstr_casecmp(hdrs[i].key, "Proxy")) {
-+            ;
-+        }
-+#endif
-         /*
-          * You really don't want to disable this check, since it leaves you
-          * wide open to CGIs stealing passwords and people viewing them

diff --git a/apache.spec b/apache.spec
index 90922092085c282d5f608ebbe127e81d7b12bc68..94b9acd4cd0759c38f9e88938c766e719ad0fad2 100644 (file)
--- a/apache.spec
+++ b/apache.spec
@@ -34,12 +34,12 @@ Summary(pt_BR.UTF-8):       Servidor HTTPD para prover serviços WWW
 Summary(ru.UTF-8):     Самый популярный веб-сервер
 Summary(tr.UTF-8):     Lider WWW tarayıcı
 Name:          apache
-Version:       2.4.23
-Release:       2
+Version:       2.4.25
+Release:       1
 License:       Apache v2.0
 Group:         Networking/Daemons/HTTP
 Source0:       http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
-# Source0-md5: 04f19c60e810c028f5240a062668a688
+# Source0-md5: 2826f49619112ad5813c0be5afcc7ddb
 Source1:       %{name}.init
 Source2:       %{name}.logrotate
 Source3:       %{name}.sysconfig
@@ -77,7 +77,6 @@ Patch1:               %{name}-layout.patch
 Patch2:                %{name}-suexec.patch
 Patch3:                %{name}-branding.patch
 Patch4:                %{name}-apr.patch
-Patch5:                %{name}-CVE-2016-5387.patch
 
 Patch7:                %{name}-syslibs.patch
 
@@ -2645,7 +2644,6 @@ Dwa programy testowe/przykładowe cgi: test-cgi and print-env.
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
-%patch5 -p1
 
 %patch7 -p1