[Bluewhite64 Linux Security] apr-util [BW64SA:20090618-02]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Bluewhite64 Linux Security] apr-util [BW64SA:20090618-02]

New apr-util (and apr) packages are available for Bluewhite64 11.0, 12.0, 12.1,
12.2 to fix security issues. The issues are with apr-util, but
older Bluewhite64 releases will require a new version of the apr package as well.

More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955




Here are the details from the Bluewhite64 Linux 12.2 ChangeLog:
- ----------------------------------------------------------------
PATCHES/packages/apr-1.3.5-x86_64-1.tgz: Upgraded.
PATCHES/packages/apr-util-1.3.7-x86_64-1.tgz: Upgraded.
Fix underflow in apr_strmatch_precompile.
Fix a denial of service attack against the apr_xml_* interface
using the "billion laughs" entity expansion technique.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955
[*** Security fix ***]



Download the new packages from:
- --------------------------------
For Bluewhite64 Linux 11.0:
http://data.bluewhite64.com/bluewhite64-11.0/patches/packages/apr-1.3.5-x86_64-1.tgz
http://data.bluewhite64.com/bluewhite64-11.0/patches/packages/apr-util-1.3.7-x86_64-1.tgz

For Bluewhite64 Linux 12.0:
http://data.bluewhite64.com/bluewhite64-12.0/patches/packages/apr-1.3.5-x86_64-1.tgz
http://data.bluewhite64.com/bluewhite64-12.0/patches/packages/apr-util-1.3.7-x86_64-1.tgz

For Bluewhite64 Linux 12.1:
http://data.bluewhite64.com/bluewhite64-12.1/patches/packages/apr-1.3.5-x86_64-1.tgz
http://data.bluewhite64.com/bluewhite64-12.1/patches/packages/apr-util-1.3.7-x86_64-1.tgz

For Bluewhite64 Linux 12.2:
http://data.bluewhite64.com/bluewhite64-12.2/patches/packages/apr-1.3.5-x86_64-1.tgz
http://data.bluewhite64.com/bluewhite64-12.2/patches/packages/apr-util-1.3.7-x86_64-1.tgz

Also, please see the "Get Bluewhite64" section on http://www.bluewhite64.com for
additional mirror sites near you.


MD5 signatures:
- ----------------
Bluewhite64 11.0 package:
16eeff37a5c9317fac40a3872a2b39fc apr-util-1.3.7-x86_64-1.tgz
3412e867b7eb9e40a0388de1153a7930 apr-1.3.5-x86_64-1.tgz

Bluewhite64 12.0 package:
47590cb6aa0487ca4e5236a019300ec4 apr-util-1.3.7-x86_64-1.tgz
c40164c814890f9fb47f3336b448ae15 apr-1.3.5-x86_64-1.tgz

Bluewhite64 12.1 package:
b98f852a57c0c809a9e7dcbeed599772 apr-util-1.3.7-x86_64-1.tgz
519c4bda0afb797c2ed3ef294c3bcc80 apr-1.3.5-x86_64-1.tgz

Bluewhite64 12.2 package:
c1f5ac55ace5fc7d2290e631f0d2ae0b apr-util-1.3.7-x86_64-1.tgz
4327e6f9210e08c4656c03ae46573c86 apr-1.3.5-x86_64-1.tgz




Installation instructions:
- ----------------------------
Upgrade the package as root:
# upgradepkg apr-util-1.3.7-x86_64-1.tgz apr-1.3.5-x86_64-1.tgz

Restart any services that use apr-util.

- ---
Bluewhite64 Linux Security Team
http://bluewhite64.com/gpg-key

security©bluewhite64.com


- ------------------------------------------------------
To leave the bluewhite64-security mailing list:
Send a blank email to

bluewhite64-security-unsubscribe©bluewhite64.com

You will get a confirmation message back containing
instructions to complete the process.

Please do not reply to this email address.
- ------------------------------------------------------


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAko6p+sACgkQpTOsxuDdlY6F3gCZAS/rCB7GP2CxQ4M98E28wcQg
QIkAmwaXpDNYOpLK6OGwLpxzAwclU0L3
=eT/I
-----END PGP SIGNATURE-----