-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Apache HTTP Server (httpd) 2.2.16 Released The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release and immediate availability of version 2.2.16 of the Apache HTTP Server ("httpd"). This version of httpd is principally a security and bug fix release. Notably, this release addresses CVE-2010-1452 (cve.mitre.org), a remote denial of service bug in mod_cache and mod_dav. This release further addresses the issue CVE-2010-2068 within mod_proxy_ajp, mod_proxy_http, mod_reqtimeout. We consider this release to be the best version of httpd available, and encourage users of all prior versions to upgrade. Apache HTTP Server 2.2.16 is available for download from: http://httpd.apache.org/download.cgi Please see the CHANGES_2.2 file, linked from the download page, for a full list of changes. A condensed list, CHANGES_2.2.16 provides the complete list of changes since 2.2.15. A summary of security vulnerabilities which were addressed in the previous 2.2.15 and earlier releases is available: http://httpd.apache.org/security/vulnerabilities_22.html Apache HTTP Server 2.2.16 is compatible with Apache Portable Runtime (APR) versions 1.3 and 1.4, APR-util library version 1.3, and APR-iconv library version 1.2. The most current releases should be used to address known security and platform bugs. At the time of this httpd release, the recommended APR releases are: * Apache Portable Runtime (APR) library version 1.4.2 (bundled), or at minimum, version 1.3.12 * ARR-util library version 1.3.9 (bundled) * APR-iconv library version 1.2.1 (bundled only with win32-src.zip) Older releases of these libraries have known vulnerabilities or other defects affecting httpd. For further information and downloads, visit: http://apr.apache.org/ Apache HTTP Server 2.2 offers numerous enhancements, bug fixes, and performance enhancements over the 2.0 codebase. For an overview of new features introduced since 2.0 please see: http://httpd.apache.org/docs/2.2/new_features_2_2.html This release builds upon and extends the httpd 2.0 API. Modules written for httpd 2.0 will need to be recompiled in order to run with httpd 2.2, and may require minimal source code changes. When upgrading or installing this version of httpd, please bear in mind that if you intend to use httpd with one of the threaded MPMs (other than the Prefork MPM), you must ensure that any modules you will be using (and the libraries they depend on) are thread-safe. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (Darwin) iEYEARECAAYFAkxMpTwACgkQ94h19kJyHwAQRwCfT6ctV3Y4Gz7HaL6ZtCgZeBe5 ODkAoKLmjxmlFMSF2Sv7PfypM3PlJm1F =6UNP -----END PGP SIGNATURE-----