| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | SECURITY: CAN-2004-0940 (cve.mitre.org) |   deraadt | 2005-01-08 | 1 | -20/+35 | |
| | | | | | | | mod_include: Fix potential buffer overflow with escaped characters in SSI tag string. [Martin Kraemer, Jim Jagielski] merged by fgsch | |||||
| * | document that suexec has to be setuid to work correctly; |   jmc | 2004-12-28 | 1 | -7/+22 | |
| | | | | | | | slightly more logical layout of the page; ok henning@ | |||||
| * | sync w/ obsd; | jmc | 2004-12-21 | 3 | -23/+29 | |
| | | ||||||
| * | apachectl is section 8, not 1; | jmc | 2004-12-20 | 1 | -2/+2 | |
| | | ||||||
| * | convert to mdoc. ok jmc |   jaredy | 2004-12-20 | 3 | -91/+131 | |
| | | ||||||
| * | .Xr dbmmanage 1 , | jmc | 2004-12-14 | 1 | -1/+2 | |
| | | ||||||
| * | convert to mdoc; | jmc | 2004-12-14 | 1 | -106/+128 | |
| | | ||||||
| * | sync usage() w/ SYNOPSIS and remove some verbosity; | jmc | 2004-12-14 | 1 | -16/+7 | |
| | | | | | ok henning@ | |||||
| * | convert to mdoc; | jmc | 2004-12-14 | 1 | -41/+59 | |
| | | ||||||
| * | OBSD sync; | jmc | 2004-12-14 | 1 | -39/+50 | |
| | | ||||||
| * | convert to mdoc; | jmc | 2004-12-14 | 1 | -184/+189 | |
| | | ||||||
| * | sync usage() w/ man page; | jmc | 2004-12-07 | 1 | -7/+7 | |
| | | ||||||
| * | sync w/ obsd behaviour + tweaks; | jmc | 2004-12-07 | 1 | -82/+93 | |
| | | ||||||
| * | convert to mdoc; | jmc | 2004-12-07 | 1 | -366/+319 | |
| | | ||||||
| * | customise for obsd + tweaks; | jmc | 2004-12-06 | 1 | -33/+67 | |
| | | | | | ok henning@ | |||||
| * | kill more dead code, mostly inside #ifdef SOMENONSENSEONSTUPIDOSES |   henning | 2004-12-06 | 47 | -1097/+10 | |
| | | | | | | | joint work by Michael Knudsen <e@molioner.dk> and Daniel Ouellet <daniel@presscom.net> with my input no change in binaries | |||||
| * | convert to mdoc; | jmc | 2004-12-06 | 1 | -84/+91 | |
| | | ||||||
| * | sync usage() w/ man page; | jmc | 2004-12-04 | 1 | -19/+19 | |
| | | | | | ok henning@ | |||||
| * | these pages not used; | jmc | 2004-12-04 | 4 | -1248/+0 | |
| | | | | | ok henning@ | |||||
| * | incredible what for shit is in this code | henning | 2004-12-04 | 1 | -7/+1 | |
| | | | | | | | | | | | adding time and date the binary was built is a really really really important and worthwile information, rrrrriiiiiiiigggggghhhht. and for sure a nice way to make the binary changes every time it is built workaround for now (return "unnown") since this stupid piece of crap function is part of the API and modules etc might (ab)use it. king bula sez: what an incredible nonsense pointed out by John Kerbawy <kerbawy@gmail.com> | |||||
| * | king bula sez: rot where the other crap rots shall these | henning | 2004-12-03 | 4 | -602/+0 | |
| | | ||||||
| * | king bula sez: in Attic/ you shall rot | henning | 2004-12-02 | 135 | -20580/+0 | |
| | | ||||||
| * | Redirected to /dev/null | henning | 2004-12-02 | 22 | -3421/+0 | |
| | | ||||||
| * | big time httpd cleanup | henning | 2004-12-02 | 89 | -7553/+24 | |
| | | | | | | | this diff removes a lot of #ifdef'd stuff that is irrelevant for us. done by Daniel Ouellet after my advice. tested by many, ok miod@ | |||||
| * | merge changes from mod_ssl 2.8.20, in particular a fix for CAN-2004-0885 | henning | 2004-10-20 | 2 | -2/+24 | |
| | | ||||||
| * | security fix: | henning | 2004-09-08 | 1 | -5/+6 | |
| | | | | | | | | | | | | | | | | | | Apache's mod_rewrite module can be made to write one zero byte in an arbitrary memory position outside of a char array, causing DoS or possibly buffer overflows. The function lookup_map_dbmfile() in modules/mappers/mod_rewrite.c copies data from a DBM file to the char array buf in a _secure_ manner, but it zero-terminates the array afterwards in an _insecure_ manner. If the key that is looked up has an n bytes long value, a zero byte will be written in the memory position n bytes from the start of the char array buf. exploiting would require enabling dbm for mod_rewrite and getting it to use a malicious dbm file. reported by Ulf.Harnhammar.9485@student.uu.se fix by me ok otto, deraadt | |||||
| * | typos from -f (PR #3907); | jmc | 2004-08-25 | 1 | -2/+2 | |
| | | ||||||
| * | Make UseCanonicalName off correctly grab port info from |   brad | 2004-07-31 | 1 | -6/+17 | |
| | | | | | | | the client. Make UseCanonicalName socket port aware. ok henning@ | |||||
| * | Fold in backport of 2.0 fix for mod_usertrack core dump | brad | 2004-07-26 | 1 | -13/+28 | |
| | | | | | | | | | when enabled but no explicit CookieName is set. From: Apache CVS ok henning@ | |||||
| * | SECURITY: CAN-2004-0492 (cve.mitre.org) | henning | 2004-06-10 | 1 | -0/+7 | |
| | | | | | | Reject responses from a remote server if sent an invalid (negative) Content-Length. [Mark Cox] | |||||
| * | get changes from mod_ssl 2.8.18: | henning | 2004-06-10 | 3 | -53/+10 | |
| | | | | | | | | | | | | *) Fix buffer overflow in "SSLOptions +FakeBasicAuth" implementation if the Subject-DN in the client certificate exceeds 6KB in length. (CVE CAN-2004-0488). *) Handle the case of OpenSSL retry requests after interrupted system calls during the SSL handshake phase. *) Remove some unused functions. | |||||
| * | mod_digest for Apache does not properly verify the nonce of a client response | brad | 2004-06-07 | 4 | -4/+102 | |
| | | | | | | | | | by using a AuthNonce secret. CAN-2003-0987 ok henning@ | |||||
| * | Apache does not filter terminal escape sequences from its error logs, which | brad | 2004-06-07 | 3 | -1/+76 | |
| | | | | | | | | | | could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences. CAN-2003-0020 ok henning@ | |||||
| * | Use arc4random(3) to compute random numbers, instead of using rand() |   otto | 2004-05-16 | 1 | -14/+6 | |
| | | | | | | | | to produce a double, snprintf()ing that into a buffer and then converting the string to an int with atoi(). ok millert@ henning@ | |||||
| * | Use arc4random(3) instead of rand(3) to compute random numbers. | otto | 2004-05-16 | 1 | -18/+6 | |
| | | | | | ok millert@ henning@ | |||||
| * | ap_server_strip_chroot() is void not int, found by otto while playing with | henning | 2004-02-10 | 2 | -3/+3 | |
| | | | | | a etoh diff | |||||
| * | Fix printf format string. ok henning@ | otto | 2004-01-15 | 4 | -8/+8 | |
| | | ||||||
| * | cast vararg sentinel value to pointer | otto | 2004-01-13 | 1 | -1/+1 | |
| | | | | | ok henning@ | |||||
| * | return value at end of non-void function | otto | 2004-01-13 | 1 | -1/+3 | |
| | | | | | ok henning@ | |||||
| * | Allow and Deny rules with IP addresses outside the class A range | henning | 2003-11-21 | 1 | -19/+22 | |
| | | | | | | | | | | | | (e.g. 192.168.1.1) where parsed incorrectly on sparc64. It only affected IP addresses with no netmask definition. The cause of this was: a) use of the wrong type -- unsigned long instead of a 32bit value b) implicit casts from int to unsigned long with sign extension While doing that fix also some other obvious bugs. from claudio jeker | |||||
| * | merge apache 1.3.29 and mod_ssl 2.8.16 | henning | 2003-11-17 | 52 | -144/+303 | |
| | | | | | ok brad@ | |||||
| * | typo from Tom Cosgrove; this appears to already be fixed in latest httpd; | jmc | 2003-10-30 | 1 | -1/+1 | |
| | | ||||||
| * | security fix from upcoming apache 1.3.29: | henning | 2003-10-29 | 4 | -14/+14 | |
| | | | | | | | | | | SECURITY: CAN-2003-0542 (cve.mitre.org) Fix buffer overflows in mod_alias and mod_rewrite which occurred if one configured a regular expression with more than 9 captures. [André Malo] ok markus@ | |||||
| * | initgroups() before chroot(), found by Daniel Lucq | henning | 2003-10-24 | 1 | -3/+9 | |
| | | | | | ok deraadt@ | |||||
| * | use u_int32_t instead of unsigned long, a 32-bit quantity is needed. |   dhartmei | 2003-10-17 | 1 | -1/+1 | |
| | | | | | ok deraadt@ | |||||
| * | ugly hack to fix digest authentication for ie, safari et al. FreeBSD PR#55401. |   jakob | 2003-10-08 | 1 | -0/+2 | |
| | | | | | ok henning@ | |||||
| * | chroot handling for SSLCertificateChainFile, problem found and fix tested by | henning | 2003-10-02 | 1 | -1/+2 | |
| | | | | | Sandor Palfy <netchan@cotse.net> | |||||
| * | use a much more random salt; prompted by ast@domdv.de | deraadt | 2003-09-26 | 1 | -4/+2 | |
| | | ||||||
| * | when dropping privileges use initgroups(3) instead of setgroups(2) so the | henning | 2003-09-19 | 1 | -4/+4 | |
| | | | | | | | secondary groups get initialized as well. ok beck@ deraadt@ | |||||
| * | these are not needed here; henning@ ok. |   fgsch | 2003-08-27 | 77 | -41236/+0 | |
| | | ||||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |