The Apache Software Foundation and the Apache HTTP Server Project have announced the release of version 1.3.42 of the Apache HTTP Server. This release is intended as the final release of version 1.3 of the Apache HTTP Server, which has reached end of life status.

There will be no more full releases of Apache HTTP Server 1.3.

However, critical security updates may be made available from the following website: http://www.apache.org/dist/httpd/patches/

This version of Apache is is principally a bug and security fix release.

The following moderate security flaw has been addressed:

* CVE-2010-0010 (cve.mitre.org)

mod_proxy: Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

Apache 1.3.42 is the final stable release of the Apache 1.3 family. We strongly recommend that users of all earlier versions, including 1.3 family releases, upgrade to to the current 2.2 version as soon as possible.

For information about how to upgrade, please see the documentation:  http://httpd.apache.org/docs/2.2/upgrading.html

Apache 1.3.42 is available for download from http://httpd.apache.org/download.cgi

Apache 1.3.42 Major changes

Security vulnerabilities

The main security vulnerabilities addressed in 1.3.42 are:

• SECURITY: CVE-2010-0010 (cve.mitre.org) mod_proxy: Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

Bugfixes addressed in 1.3.42 are:

• Protect logresolve from mismanaged DNS records that return blank/null hostnames.