Changes with Apache 2.0.46
+ *) SECURITY [CAN-2003-0245]: Fixed a bug causing apr_pvsprintf() to crash
+ by sending an overly long string. This can be triggered remotely
+ through mod_dav, mod_ssl, and other mechanisms. Reported by David
+ Endler <DEndler@iDefense.com>.
+ [Joe Orton <jorton@redhat.com>]
+
+ *) SECURITY [CAN-2003-0189]: Fixed a denial-of-service vulnerability
+ affecting basic authentication on Unix platforms related to
+ thread-safety in apr_password_validate(). The problem was reported
+ by John Hughes <john.hughes@entegrity.com>.
+
*) Fix for mod_dav. Call the 'can_be_activity' callback, if provided,
when a MKACTIVITY request comes in.
[Ben Collins-Sussman <sussman@collab.net>]