Debian: DSA-594-1 Critical Vulnerability in Apache Due to Buffer Overflow

Two vulnerabilities have been identified in the Apache 1.3 webserver:

CAN-2004-0940

"Crazy Einstein" has discovered a vulnerability in the
"mod_include" module, which can cause a buffer to be overflown and
could lead to the execution of arbitrary code.

NO VULN ID

Larry Cashdollar has discovered a potential buffer overflow in the
htpasswd utility, which could be exploited when user-supplied is
passed to the program via a CGI (or PHP, or ePerl, ...) program.

For the stable distribution (woody) these problems have been fixed in
version 1.3.26-0woody6.

For the unstable distribution (sid) these problems have been fixed in
version 1.3.33-2.

We recommend that you upgrade your apache packages.


Upgrade Instructions
--------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get...