Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
A bug in Apache may allow a remote attacker to perform a Denial of
Service attack.

Background
==========
Apache is the world's most popular HTTP server, being quite possibly the
best around in terms of functionality, efficiency, security and speed.

Description
===========
Filip Sneppe discovered that Apache improperly handles byterange
requests to CGI scripts. This could be used to exhaust RAM and swap on
the server, resulting in a DoS of the server.

Affected packages
=================
apache2 in all grimoires is affected. This is now fixed in devel, test,
stable-rc 0.2 and stable 0.1 grimoires.

Resolution
==========
All apache2 users should upgrade to the latest available version:
         # scribe update
         # cast -c apache2

References
==========
   [ 1 ] ASF Bugzilla Bug 29962
         http://issues.apache.org/bugzilla/show_bug.cgi?id=29962
   [ 2 ] GLSA 200508-15
         http://security.gentoo.org/glsa/glsa-200508-15.xml

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature