Changes with Apache 2.3.3
+ *) SECURITY: CVE-2009-3095 (cve.mitre.org)
+ mod_proxy_ftp: sanity check authn credentials.
+ [Stefan Fritsch <sf fritsch.de>, Joe Orton]
+
+ *) SECURITY: CVE-2009-3094 (cve.mitre.org)
+ mod_proxy_ftp: NULL pointer dereference on error paths.
+ [Stefan Fritsch <sf fritsch.de>, Joe Orton]
+
+ *) Allow ProxyPreserveHost to work in <Proxy> sections. PR 34901.
+ [Stefan Fritsch]
+
+ *) configure: Fix THREADED_MPMS so that mod_cgid is enabled again
+ for worker MPM. [Takashi Sato]
+
+ *) mod_dav: Provide a mechanism to obtain the request_rec and pathname
+ from the dav_resource. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) Build: Use install instead of cp if available on installing
+ modules to avoid segmentation fault. PR 47951. [hirose31 gmail.com]
+
+ *) mod_cache: correctly consider s-maxage in cacheability
+ decisions. [Dan Poirier]
+
+ *) mod_logio/core: Report more accurate byte counts in mod_status if
+ mod_logio is loaded. PR 25656. [Stefan Fritsch]
+
+ *) mod_ldap: If LDAPSharedCacheSize is too small, try harder to purge
+ some cache entries and log a warning. Also increase the default
+ LDAPSharedCacheSize to 500000. This is a more realistic size suitable
+ for the default values of 1024 for LdapCacheEntries/LdapOpCacheEntries.
+ PR 46749. [Stefan Fritsch]
+
+ *) mod_rewrite: Make sure that a hostname:port isn't fully qualified if
+ the request is a CONNECT request. [Bill Zajac <billz consultla.com>]
+
+ *) mod_cache: Teach CacheEnable and CacheDisable to work from within a
+ Location section, in line with how ProxyPass works. [Graham Leggett]
+
+ *) mod_reqtimeout: New module to set timeouts and minimum data rates for
+ receiving requests from the client. [Stefan Fritsch]
+
+ *) core: Fix potential memory leaks by making sure to not destroy
+ bucket brigades that have been created by earlier filters.
+ [Stefan Fritsch]
+
+ *) core, mod_deflate, mod_sed: Reduce memory usage by reusing bucket
+ brigades in several places. [Stefan Fritsch]
+
+ *) mod_cache: Fix uri_meets_conditions() so that CacheEnable will
+ match by scheme, or by a wildcarded hostname. PR 40169
+ [Peter Grandi <pg_asf asf.for.sabi.co.uk>, Graham Leggett]
+
+ *) suxec: Allow to log an error if exec fails by setting FD_CLOEXEC
+ on the log file instead of closing it. PR 10744. [Nicolas Rachinsky]
+
+ *) mod_mime: Make RemoveType override the info from TypesConfig.
+ PR 38330. [Stefan Fritsch]
+
+ *) mod_cache: Introduce the option to run the cache from within the
+ normal request handler, and to allow fine grained control over
+ where in the filter chain content is cached. [Graham Leggett]
+
+ *) core: Treat timeout reading request as 408 error, not 400.
+ Log 408 errors in access log as was done in Apache 1.3.x.
+ PR 39785 [Nobutaka Mantani <nobutaka nobutaka.org>,
+ Stefan Fritsch <sf fritsch.de>, Dan Poirier]
+
+ *) mod_ssl: Reintroduce SSL_CLIENT_S_DN, SSL_CLIENT_I_DN, SSL_SERVER_S_DN,
+ SSL_SERVER_I_DN back to the environment variables to be set by mod_ssl.
+ [Peter Sylvester <peter.sylvester edelweb.fr>]
+
+ *) mod_disk_cache: don't cache incomplete responses, per RFC 2616, 13.8.
+ PR15866. [Dan Poirier]
+
+ *) ab: ab segfaults in verbose mode on https sites
+ PR46393. [Ryan Niebur]
+
+ *) mod_dav: Allow other modules to become providers and add resource types
+ to the DAV response. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) mod_dav: Allow other modules to add things to the DAV or Allow headers
+ of an OPTIONS request. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) core: Lower memory usage of core output filter.
+ [Stefan Fritsch <sf sfritsch.de>]
+
+ *) mod_mime: Detect invalid use of MultiviewsMatch inside Location and
+ LocationMatch sections. PR47754. [Dan Poirier]
+
+ *) mod_request: Make sure the KeptBodySize directive rejects values
+ that aren't valid numbers. [Graham Leggett]
+
+ *) mod_session_crypto: Sanity check should the potentially encrypted
+ session cookie be too short. [Graham Leggett]
+
+ *) mod_session.c: Prevent a segfault when session is added but not
+ configured. [Graham Leggett]
+
+ *) htcacheclean: 19 ways to fail, 1 error message. Fixed. [Graham Leggett]
+
+ *) mod_auth_digest: Fail server start when nonce count checking
+ is configured without shared memory, or md5-sess algorithm is
+ configured. [Dan Poirier]
+
+ *) mod_proxy_connect: The connect method doesn't work if the client is
+ connecting to the apache proxy through an ssl socket. Fixed.
+ PR29744. [Brad Boyer, Mark Cave-Ayland, Julian Gilbey, Fabrice Durand,
+ David Gence, Tim Dodge, Per Gunnar Hans, Emmanuel Elango,
+ Kevin Croft, Rudolf Cardinal]
+
+ *) mod_ssl: The error message when SSLCertificateFile is missing should
+ at least give the name or position of the problematic virtual host
+ definition. [Stefan Fritsch sf sfritsch.de]
+
+ *) mod_auth_digest: Fix null pointer when qop=none. [Dan Poirier]
+
+ *) Add support for HTTP PUT to ab. [Jeff Barnes <jbarnesweb yahoo.com>]
+
+ *) mod_headers: generalise the envclause to support expression
+ evaluation with ap_expr parser [Nick Kew]
+
+ *) mod_cache: Introduce the thundering herd lock, a mechanism to keep
+ the flood of requests at bay that strike a backend webserver as
+ a cached entity goes stale. [Graham Leggett]
+
+ *) mod_auth_digest: Fix usage of shared memory and re-enable it.
+ PR 16057 [Dan Poirier]
+
+ *) Preserve Port information over internal redirects
+ PR 35999 [Jonas Ringh <jonas.ringh cixit.se>]
+
+ *) Proxy: unable to connect to a backend is SERVICE_UNAVAILABLE,
+ rather than BAD_GATEWAY or (especially) NOT_FOUND.
+ PR 46971 [evanc nortel.com]
+
+ *) Various modules: Do better checking of pollset operations in order to
+ avoid segmentation faults if they fail. PR 46467
+ [Stefan Fritsch <sf sfritsch.de>]
+
+ *) mod_autoindex: Correctly create an empty cell if the description
+ for a file is missing. PR 47682 [Peter Poeml <poeml suse.de>]
+
+ *) ab: Fix broken error messages after resolver or connect() failures.
+ [Jeff Trawick]
+
+ *) SECURITY: CVE-2009-1890 (cve.mitre.org)
+ Fix a potential Denial-of-Service attack against mod_proxy in a
+ reverse proxy configuration, where a remote attacker can force a
+ proxy process to consume CPU time indefinitely. [Nick Kew, Joe Orton]
+
*) SECURITY: CVE-2009-1191 (cve.mitre.org)
mod_proxy_ajp: Avoid delivering content from a previous request which
failed to send a request body. PR 46949 [Ruediger Pluem]
+ *) htdbm: Fix possible buffer overflow if dbm database has very
+ long values. PR 30586 [Dan Poirier]
+
+ *) core: Return APR_EOF if request body is shorter than the length announced
+ by the client. PR 33098 [ Stefan Fritsch <sf sfritsch.de>]
+
+ *) mod_suexec: correctly set suexec_enabled when httpd is run by a
+ non-root user and may have insufficient permissions.
+ PR 42175 [Jim Radford <radford blackbean.org>]
+
+ *) mod_ssl: Fix SSL_*_DN_UID variables to use the 'userID' attribute
+ type. PR 45107. [Michael Ströder <michael stroeder.com>,
+ Peter Sylvester <peter.sylvester edelweb.fr>]
+
+ *) mod_proxy_http: fix case sensitivity checking transfer encoding
+ PR 47383 [Ryuzo Yamamoto <ryuzo.yamamoto gmail.com>]
+
+ *) mod_alias: ensure Redirect issues a valid URL.
+ PR 44020 [Håkon Stordahl <hakon stordahl.org>]
+
+ *) mod_dir: add FallbackResource directive, to enable admin to specify
+ an action to happen when a URL maps to no file, without resorting
+ to ErrorDocument or mod_rewrite. PR 47184 [Nick Kew]
+
+ *) mod_cgid: Do not leak the listening Unix socket file descriptor to the
+ CGI process. PR 47335 [Kornél Pál <kornelpal gmail.com>]
+
+ *) mod_rewrite: Remove locking for writing to the rewritelog.
+ PR 46942 [Dan Poirier <poirier pobox.com>]
+
+ *) mod_alias: check sanity in Redirect arguments.
+ PR 44729 [Sönke Tesch <st kino-fahrplan.de>, Jim Jagielski]
+
*) mod_proxy_http: fix Host: header for literal IPv6 addresses.
PR 47177 [Carlos Garcia Braschi <cgbraschi gmail.com>]