* SECURITY: CVE-2010-1623 (cve.mitre.org)
Fix a denial of service attack against apr_brigade_split_line().

* SECURITY: CVE-2009-3560, CVE-2009-3720 (cve.mitre.org)
Fix two buffer over-read flaws in the bundled copy of expat which
could cause httpd to crash while parsing specially-crafted
XML documents.

We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.

Apache HTTP Server 2.2.17 is available for download from:

http://httpd.apache.org/download.cgi

Apache HTTP Server 2.0.64 legacy release is also currently available,
with the same vulnerability correction as well as many others fixed in
2.2.16 and earlier releases. See the corresponding CHANGES files linked
from the download page. The Apache HTTP Project developers strongly
encourage all users to migrate to Apache 2.2, as only limited and less
frequent maintenance is provided for legacy versions.

Apache 2.2 offers numerous enhancements, improvements, and performance
boosts over the 2.0 codebase. For an overview of new features
introduced since 2.0 please see:

http://httpd.apache.org/docs/2.2/new_features_2_2.html

Please see the CHANGES_2.2 file, linked from the download page, for a
full list of changes. A condensed list, CHANGES_2.2.17 provides the
complete list of changes since 2.2.16. A summary of all of the security
vulnerabilities addressed in this and earlier releases is available:

http://httpd.apache.org/security/vul…lities_22.html

This release includes the Apache Portable Runtime (APR) version 1.4.2
and APR Utility Library (APR-util) version 1.3.10, bundled with the tar
and zip distributions. The APR libraries libapr and libaprutil (and
on Win32, libapriconv version 1.2.1) must all be updated to ensure
binary compatibility and address many known security and platform bugs.

This release builds on and extends the Apache 2.0 API. Modules written
for Apache 2.0 will need to be recompiled in order to run with Apache
2.2, and require minimal or no source code changes.

http://svn.apache.org/repos/asf/http…2.x/VERSIONING

When upgrading or installing this version of Apache, please bear in mind
that if you intend to use Apache with one of the threaded MPMs (other
than the Prefork MPM), you must ensure that any modules you will be
using (and the libraries they depend on) are thread-safe.

See the “ACL handling bugs” message for more details about the ACL
merging bug.

* acl: Fixed the logic of merging multiple ACL entries. Now it works as
documented, while previously it could have done slightly different
things depending on the order of the entries.

* acl: Don’t give admin rights to all owner mailboxes. This was
originally done to make sure that mailbox owner couldn’t accidentally
remove their own admin rights. But this is already prevented by
SETACL command, so it’s not necessary. Also sysadmin may have
intentionally removed some admin rights from some mailboxes
(especially when using symlinked shared mailboxes).

- Maildir: Fixed potential “Duplicate file entry” in dovecot-uidlist
file errors.
- Maildir: Avoid unnecessary uidlist recreation during mail delivery.
- imap: When SELECT fails, it didn’t close the previous mailbox.
- Dovecot master process could have died if it got SIGCHLD signals
very rapidly while it was trying to log. This could have happened
for example if a lot of imap/pop3 sessions disconnected at the exact
same time.

Security Enhancements and Fixes in PHP 5.2.10:

• Fixed bug #48378 (exif_read_data() segfaults on certain corrupted .jpeg files). (Pierre)

Key enhancements in PHP 5.2.10 include:

• Added “ignore_errors” option to http fopen wrapper. (David Zulke, Sara)
• Fixed memory corruptions while reading properties of zip files. (Ilia)
• Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
• Fixed segfault on invalid session.save_path. (Hannes)
• Fixed leaks in imap when a mail_criteria is used. (Pierre)
• Changed default value of array_unique()’s optional sorting type parameter back to SORT_STRING to fix backwards compatibility breakage introduced in PHP 5.2.9. (Moriyoshi)
• Fixed bug #47940 (memory leaks in imap_body). (Pierre, Jake Levitt)
• Fixed bug #47903 (“@” operator does not work with string offsets). (Felipe)
• Fixed bug #47644 (Valid integers are truncated with json_decode()). (Scott)
• Fixed bug #47564 (unpacking unsigned long 32bit big endian returns wrong result). (Ilia)
• Fixed bug #47365 (ip2long() may allow some invalid values on certain 64bit systems).
• Over 100 bug fixes.

For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available here, detailing the changes between those releases and PHP 5.2.10.

For a full list of changes in PHP 5.2.10, see the ChangeLog.

“We’re seeing an entirely new technique,” said HD Moore, the creator of the Metasploit penetration testing framework, who with a hacker identified as “I)ruid,” published exploits last week for the vulnerability in the Internet’s routing system.

Read more at Linux World