httpd-2.2.3-43.3.0.1.AXS3

The Apache HTTP Server is a powerful, efficient, and extensible web server.
Security issues fixed with this release;
CVE-2010-1452
The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
CVE-2010-2791
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
Fixed bugs:
- upgraded mod_deflate to the newer upstream version from Apache HTTP Server 2.2.15 to fix numerous issues in the INFLATE filter.
- corrupted response if mod_filter applied the DEFLATE filter to a resource requiring a subrequest with an internal redirect.
- the OID() function in the mod_ssl 'SSLRequire' directive failed to properly evaluate extensions of an unknown type.