Apache HTTP Server 2.2.6

最流行的HTTP服务器软件之一.快速、可靠、可通过简单的API扩展,Perl/Python解释器可被编译到服务器中,完全免费,完全源代码开放.

下载: http://httpd.apache.org/download.cgi

官网:http://httpd.apache.org

Changes with Apache 2.2.6



  *) SECURITY: CVE-2007-3847 (cve.mitre.org)

     mod_proxy: Prevent reading past the end of a buffer when parsing

     date-related headers.  PR 41144.

     [Davi Arnaut, Nick Kew]



  *) SECURITY: CVE-2007-1863 (cve.mitre.org)

     mod_cache: Prevent a segmentation fault if attributes are listed in a 

     Cache-Control header without any value. 

     [Niklas Edmundsson ]



  *) SECURITY: CVE-2007-3304 (cve.mitre.org)

     prefork, worker, event MPMs: Ensure that the parent process cannot

     be forced to kill processes outside its process group. 

     [Joe Orton, Jim Jagielski]



  *) SECURITY: CVE-2006-5752 (cve.mitre.org)

     mod_status: Fix a possible XSS attack against a site with a public

     server-status page and ExtendedStatus enabled, for browsers which

     perform charset "detection".  Reported by Stefan Esser.  [Joe Orton]



  *) SECURITY: CVE-2007-1862 (cve.mitre.org)

     mod_mem_cache: Copy headers into longer lived storage; header names and

     values could previously point to cleaned up storage.  PR 41551.

     [Davi Arnaut ]



  *) mod_info: mod_info outputs invalid XHTML 1.0 transitional.

     PR 42847 [Rici Lake ]



  *) mod_ssl: Fix spurious hostname mismatch warning for valid

     wildcard certificates.  PR 37911.  [Nick Burch ]



  *) mod_mem_cache: Increase the minimum and default value for

     MCacheMinObjectSize from 0 to 1, as a MCacheMinObjectSize of 0 does not

     make sense and leads to a division by zero.  PR 40576.

     [Xuekun Hu ]



  *) mod_cache: Remove expired content from cache that cannot be revalidated.

     PR 30370. [Ruediger Pluem]



  *) mod_proxy_http: accept proxy-sendchunked/proxy-sendchunks as synonymous.

     PR 43183 [Brian Rectanus , Vincent Bray]



  *) mod_proxy: Ensure that at least scheme://hostname[:port] matches between

     worker and URL when searching for the best fitting worker for a given URL.

     PR 40910 [Ruediger Pluem]



  *) mod_proxy: Improve network performance by setting APR_TCP_NODELAY

     (disable Nagle algorithm) on sockets if implemented.

     PR 42871 [Christian BOITEL , Jim Jagielski]



  *) core: Do not replace a Date header set by a proxied backend server.

     PR 40232 [Ruediger Pluem]



  *) mod_proxy: Add a missing assignment in an error checking code path.

     PR 40865 [Andrew Rucker Jones ]



  *) mod_proxy_connect: avoid segfault on DNS lookup failure.

     PR 40756 [Trevin Beattie ]



  *) mod_proxy: enable Ignore Errors option on ProxyPass Status.

     PR 43167 [Francisco Gimeno 



  *) mod_proxy_http: Don't try to read body of a HEAD request before

     responding.  PR 41644 [Stuart Children ]



  *) mod_authnz_ldap: Don't return HTTP_UNAUTHORIZED during authorization when

     LDAP authentication is configured but we haven't seen any 

     'Require ldap-*' directives, allowing authorization to be passed to lower 

     level modules (e.g. Require valid-user) 

     PR 43281 [Eric Covener]



  *) mod_proxy: don't URLencode tilde in path component

     PR 38448 [Stijn Hoop ]



  *) proxy/ajp_header.c: Fixed header token string comparisons

     Matching of header tokens failed to include the trailing NIL byte

     and could misinterpret a longer header token for a shorter.

     Additionally, a "Content-Type" comparison was made case insensitive.

     [Martin Kraemer]



  *) proxy/ajp_header.c: Backport of an AJP protocol fix for EBCDIC

     On EBCDIC machines, the status_line string was incorrectly converted

     twice. [Jean-Frederic Clere, Martin Kraemer]



  *) mod_dumpio: Fix for correct dumping of traffic on EBCDIC hosts

     Data had been incorrectly converted twice, resulting in

     garbled log output. [Martin Kraemer]



  *) mod_autoindex: Add in Type and Charset options to IndexOptions

     directive. This allows the admin to explicitly set the 

     content-type and charset of the generated page and is therefore

     a viable workaround for buggy browsers affected by CVE-2007-4465

     (cve.mitre.org). [Jim Jagielski]



  *) log core: ensure we use a special pool for stderr logging, so that

     the stderr channel remains valid from the time plog is destroyed,

     until the time the open_logs hook is called again.  [William Rowe]



  *) mod_negotiation: preserve Query String in resolving a type map

     PR 33112 [J酶rgen Thomsen , Nick Kew]



  *) mod_ssl: Version reporting update; displays 'compiled against'

     Apache and build-time SSL Library versions at loglevel [info],

     while reporting the run-time SSL Library version in the server

     info tags.  Helps to identify a mod_ssl built against one flavor

     of OpenSSL but running against another (also adds SSL-C version

     number reporting.)  [William Rowe]



  *) mime.types: Many updates to sync with IANA registry and common

     unregistered types that the owners refuse to register.  Admins

     are encouraged to update their installed mime.types file.

     PR: 35550, 37798, 39317, 31483 [Roy T. Fielding]



  *) mod_expires: don't crash on bad configuration data

     PR 43213 [Julien Perez ]



  *) mod_dbd: Introduce configuration groups to allow inheritance by virtual

     hosts of database configurations from the main server.  Determine the

     minimal set of distinct configurations and share connection pools

     whenever possible.  Allow virtual hosts to override inherited SQL

     statements.  PR 41302.  [Chris Darroch]



  *) mod_dbd: Create memory sub-pools for each DB connection and close

     DB connections in a pool cleanup function.  Ensure prepared statements

     are destroyed before DB connection is closed.  When using reslists,

     prevent segfaults when child processes exit, and stop memory leakage

     of ap_dbd_t structures.  Avoid use of global s->process->pool, which

     isn't destroyed by exiting child processes in most multi-process MPMs.

     PR 39985.  [Chris Darroch, Nick Kew]



  *) mod_dbd: Handle error conditions in dbd_construct() properly.

     Simplify ap_dbd_open() and use correct arguments to apr_dbd_error()

     when non-threaded.  Register correct cleanup data in non-threaded

     ap_dbd_acquire() and ap_dbd_cacquire().  Clean up configuration data

     and merge function.  Use ap_log_error() wherever possible.

     [Chris Darroch, Nick Kew]



  *) mod_dbd: Stash DBD connections in request_config of initial request

     only, or else sub-requests and internal redirections may cause

     entire DBD pool to be stashed in a single HTTP request.  [Chris Darroch]



  *) main core: Emit errors during the initial apr_app_initialize()

     or apr_pool_create() (when apr-based error reporting is not ready).

     [William Rowe, Jeff Trawick]



  *) log core: fix the new piped logger case where we couldn't connect 

     the replacement stderr logger's stderr to the NULL stdout stream.  

     Continue in this case, since the previous alternative of no error 

     logging at all (/dev/null) is far worse. [William Rowe]



  *) mpm_winnt: Prevent the parent-child pipe from leaking into other

     spawned processes, and ensure we have a /Device/null handle for

     stdout when running as-a-service.  [William Rowe]



  *) mod_ldap: Avoid possible crashes, hangs, and busy loops due to

     improper merging of the cache lock in vhost config

     PR 43164 [Eric Covener]



  *) ApacheMonitor: Fix Windows Vista detection. [Mladen Turk]



  *) mod_deflate: fix protocol handling in deflate input filter

     PR 23287 [Nick Kew]



  *) mime.types: add Registered Javascript/ECMAScript MIME types (RFC4329)

     PR 40299 [Dave Hodder ]



  *) mod_filter: fix integer comparisons in dispatch rules

     PR 41835 [Nick Kew]



  *) mod_filter: fix merging of ! and = in FilterChain

     PR 42186 [Issac Goldstand ]



  *) mod_deflate: don't try to process metadata buckets as data.  what should

     have been a 413 error was logged as a 500 and a blank screen appeared

     at the browser.

     [Greg Ames, Ruediger Pluem]



  *) mod_cgi, mod_cgid: Fix use of CGI scripts as ErrorDocuments.

     PR 39710.  [Paul Querna, Ruediger Pluem]



  *) mod_proxy: Allow to use different values for sessionid

     in url encoded id and cookies. PR 41897. [Jean-Frederic Clere]



  *) mod_proxy: Fix the 503 returned when session route does

     not match any of the balancer members. [Mladen Turk]



  *) mod_proxy: Added ProxyPassMatch directive, which is similar

     to ProxyPass but takes a regex local path prefix. [Jim Jagielski]



  *) mod_cache: Do not set Date or Expires when they are missing from

     the original response or are invalid.  [Justin Erenkrantz]



  *) mod_cache: Correctly handle HEAD requests on expired cache content.

     PR 41230.  [Niklas Edmundsson ]



  *) mod_cache: Let Cache-Control max-age set the expiration of the cached

     representation if Expires is not set.  [Justin Erenkrantz]



  *) mod_cache: Allow caching of requests with query arguments when

     Cache-Control max-age is explicitly specified.  [Justin Erenkrantz]



  *) mod_disk_cache: Allow Vary'd responses to be refreshed properly.

     [Justin Erenkrantz]



  *) mod_proxy: Print the correct error message for erroneous configured

     ProxyPass directives. PR 40439.  [Takashi Sato ]



  *) mod_so: Provide more helpful LoadModule feedback when an error occurs.

     [William Rowe]



  *) mod_alias: Accept path components (URL part) in Redirects. PR 35314.

     [Nick Kew]



  *) mod_headers: Allow % at the end of a Header value. PR 36609.

     [Nick Kew, Ruediger Pluem]



  *) mod_cache: Use the same cache key throughout the whole request processing

     to handle escaped URLs correctly.  PR 41475.  [Ruediger Pluem]



  *) mod_cache: Add CacheIgnoreQueryString directive. PR 41484.

     [Fredrik Widlund ]



  *) mod_cache: While serving a cached entity ensure that filters that have

     been applied to this cached entity before saving it to the cache are not

     applied again. PR 40090.  [Ruediger Pluem]



  *) mod_cache: Correctly cache objects whose URL query string has been

     modified by mod_rewrite. PR 40805.  [Ruediger Pluem]



  *) HTTP proxy ProxyErrorOverride: Leave 1xx and 3xx responses alone.  Only

     processing of error responses (4xx, 5xx) will be altered. PR 39245.

     [Jeff Trawick, Bart van der Schans ]



  *) htdbm: Enable crypt support on platforms with crypt() but not

     , such as z/OS.  [David Jones ]



  *) mod_ssl: initialize thread locks before initializing the hardware

     acceleration library, so the latter can make use of the former.

     PR 20951.  []



  *) ab.c: Correct behavior of HTTP request headers sent by ab

     in presence of -H command-line overrides. PR 31268, 26554.

     [Arvind Srinivasan ]



  *) ab.c: The apr_port_t type is unsigned, but ab was using a

     signed format code in its reports. PR 42070.

     [Takashi Sato ]



  *) mod_ldap: Remove the hardcoded size limit parameter for

     ldap_search_ext_s and replace it with an APR_ defined

     value that is set according to the LDAP SDK being used.

     [David Jones ]



  *) core: Correct a regression since 2.0.x in the handling of AllowOverride 

     Options. PR 41829.  [Torsten F枚rtsch ]



  *) mod_proxy_http: Handle request bodies larger than 2 GB by converting

     the Content-Length header of the request correctly. PR 40883.

     [Ruediger Pluem, toadie ]



  *) mod_proxy: Fix some proxy setting inheritance problems (eg:

     ProxyTimeout). PR 11540.  [Stuart Children ]



  *) Unix MPMs: Catch SIGFPE so that exception hooks and CoreDumpDirectory

     can work after that terminating signal.

     [Eric Covener]



  *) Win32: Makefile.win will now build with MS VC 8 (Visual Studio 2005)

     including embedding the .manifest information into each binary.

     [William Rowe]



There was no Apache 2.2.5




            文章地址:   http://www.xinasp.com/html/yeshuowangzhan/jianzhangongju/20070909/35570.shtml 

            TAG：Apache HTTP Server 2.2 
		  
		  
		  
		  共2页: 上一页 1 [2] 下一页