Apache Server 2.4.3 fixes over fifty bugs and two security holes

The two gaps have been listed as CVE-2012-3502 and CVE-2012-2687, but there is little information available on the actual problems. The first bug happens with mod_proxy_sjp and mod_proxy_http in the backend when a connection is closing which “could lead to privacy issues due to a response mixup”. The second problem, in mod_negotiation, concerns a possible XSS (cross-site scripting) where untrusted users are uploading files; it is fixed by escaping file names.