The remote host is missing an update to apr-util announced via advisory FEDORA-2009-6014.

Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update apr-util' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-6014

Update Information: Backport security fixes from upstream version 1.3.7: - CVE-2009-0023 Fix underflow in apr_strmatch_precompile. - CVE-2009-1955 Fix a denial of service attack against the apr_xml_* interface using the billion laughs entity expansion technique. - CVE-2009-1956 Fix off by one overflow in apr_brigade_vprintf. Note: CVE-2009-1956 is only an issue on big-endian architectures. ChangeLog: * Mon Jun 8 2009 Bojan Smojver - 1.2.12-7 - include missing bit of the apr_strmatch.c patch * Mon Jun 8 2009 Bojan Smojver - 1.2.12-6 - CVE-2009-0023 - billion laughs fix of apr_xml_* interface - off by one in apr_brigade_vprintf * Wed Jun 11 2008 Dennis Gilmore - 1.2.12-5.1 - minor rebuild on sparc

• https://bugzilla.redhat.com/show_bug.cgi?id=503928
• https://bugzilla.redhat.com/show_bug.cgi?id=504390
• https://bugzilla.redhat.com/show_bug.cgi?id=504555

---

Updated on 2015-03-25