openSUSE 11.4: 2014:0496-1 Critical Alert for lighttpd SQL Injection

lighttpd was updated to version 1.4.35, fixing bugs and

security issues:

CVE-2014-2323: SQL injection vulnerability in

mod_mysql_vhost.c in lighttpd allowed remote attackers to

execute arbitrary SQL commands via the host name, related

to request_check_hostname.

CVE-2014-2323: Multiple directory traversal vulnerabilities

in (1) mod_evhost and (2) mod_simple_vhost in lighttpd

allowed remote attackers to read arbitrary files via a ..

(dot dot) in the host name, related to

request_check_hostname.

More information can be found on the lighttpd advisory

page:

014_01.txt

Other changes:

* [network/ssl] fix build error if TLSEXT is disabled

* [mod_fastcgi] fix use after free (only triggered if

fastcgi debug is active)

* [mod_rrdtool] fix invalid read (string not null

terminated)

* [mod_dirlisting] fix memory leak if pcre fails

* [mod_fastcgi,mod_scgi] fix resource leaks on spawning

backends

* [mod_magnet] fix memory...