shield Security update for apache2-mod_fcgid

sdksp4-apache2-mod_fcgid-12653

This update for apache2-mod_fcgid fixes the following issues: * It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-1000104). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988492)

• Release Date
  Jul 18 2016
• References
  Bugzilla: 988492
  CVEs: CVE-2016-1000104
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Enterprise Software Development Kit 11.4 unknown

• Packages
  apache2-mod_fcgid
  Alternative FastCGI module for Apache2

  2.2-31.29.1 lock rpm lock src

SUSE Linux Enterprise Software Development Kit 11.4 unknown

• Packages
  apache2-mod_fcgid
  Alternative FastCGI module for Apache2

  2.2-31.29.1 lock rpm lock src

SUSE Linux Enterprise Software Development Kit 11.4 unknown

• Packages
  apache2-mod_fcgid
  Alternative FastCGI module for Apache2

  2.2-31.29.1 lock rpm lock src

SUSE Linux Enterprise Software Development Kit 11.4 unknown

• Packages
  apache2-mod_fcgid
  Alternative FastCGI module for Apache2

  2.2-31.29.1 lock rpm lock src

SUSE Linux Enterprise Software Development Kit 11.4 unknown

• Packages
  apache2-mod_fcgid
  Alternative FastCGI module for Apache2

  2.2-31.29.1 lock rpm lock src