Hi once more, hopefully the last time in a while. An update for libapache-mod-security in Squeeze is also needed to fix CVE-2013-2765. Also attached the corresponding debdiff.
Thanks, Alberto -- Alberto Gonzalez Iniesta | Formación, consultoría y soporte técnico agi@(inittab.org|debian.org)| en GNU/Linux y software libre Encrypted mail preferred | http://inittab.com Key fingerprint = 5347 CBD8 3E30 A9EB 4D7D 4BF2 009B 3375 6B9A AA55
diff -Nru libapache-mod-security-2.5.12/debian/changelog libapache-mod-security-2.5.12/debian/changelog --- libapache-mod-security-2.5.12/debian/changelog 2012-07-02 14:47:51.000000000 +0000 +++ libapache-mod-security-2.5.12/debian/changelog 2013-06-04 10:15:00.000000000 +0000 @@ -1,3 +1,10 @@ +libapache-mod-security (2.5.12-1+squeeze2) squeeze; urgency=low + + * Applied upstream patch to fix NULL pointer dereference. + CVE-2013-2765. (Closes: #710217) + + -- Alberto Gonzalez Iniesta <[email protected]> Tue, 04 Jun 2013 10:14:45 +0000 + libapache-mod-security (2.5.12-1+squeeze1) stable-security; urgency=high * CVE-2012-2751: Fix multi-part bypass due to wrong quoting. diff -Nru libapache-mod-security-2.5.12/debian/patches/CVE-2013-2765.patch libapache-mod-security-2.5.12/debian/patches/CVE-2013-2765.patch --- libapache-mod-security-2.5.12/debian/patches/CVE-2013-2765.patch 1970-01-01 00:00:00.000000000 +0000 +++ libapache-mod-security-2.5.12/debian/patches/CVE-2013-2765.patch 2013-06-04 10:16:27.000000000 +0000 @@ -0,0 +1,12 @@ +Index: libapache-mod-security-2.5.12/apache2/msc_reqbody.c +=================================================================== +--- libapache-mod-security-2.5.12.orig/apache2/msc_reqbody.c 2013-06-04 10:16:16.319901192 +0000 ++++ libapache-mod-security-2.5.12/apache2/msc_reqbody.c 2013-06-04 10:16:22.995934300 +0000 +@@ -139,6 +139,7 @@ + + /* Would storing this chunk mean going over the limit? */ + if ((msr->msc_reqbody_spilltodisk) ++ && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON) + && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit)) + { + msc_data_chunk **chunks; diff -Nru libapache-mod-security-2.5.12/debian/patches/series libapache-mod-security-2.5.12/debian/patches/series --- libapache-mod-security-2.5.12/debian/patches/series 2012-07-02 14:44:34.000000000 +0000 +++ libapache-mod-security-2.5.12/debian/patches/series 2013-06-04 10:15:47.000000000 +0000 @@ -1 +1,2 @@ CVE-2012-2751.patch +CVE-2013-2765.patch
