—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

APPLE-SA-2016-09-20-4 macOS Server 5.2

macOS Server 5.2 is now available and addresses the following:

apache
Available for: macOS 10.12 Sierra
Impact: A remote attacker may be able to proxy traffic through an
arbitrary server
Description: An issue existed in the handling of the HTTP_PROXY
environment variable. This issue was addressed by not setting the
HTTP_PROXY environment variable from CGI.
CVE-2016-4694 : Dominic Scheirlinck and Scott Geary of Vend

ServerDocs Server
Available for: macOS 10.12 Sierra
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: RC4 was removed as a supported cipher.
CVE-2016-4754 : Pepi Zawodsky

macOS Server 5.2 may be obtained from the Mac App Store.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple’s Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
—–BEGIN PGP SIGNATURE—–
Comment: GPGTools – https://gpgtools.org

iQIcBAEBCgAGBQJX4YD4AAoJEIOj74w0bLRGbWQP+gOZSLCIIprhLJ6wLJp1Hbb+
gxS09PZJSp32xDnmyMdzcKUFsQ8UfO9iSZBs7Yge8nAjQLxKt/dlopXZPIg4t4GY
qSx1wOZ3yj+74LBnhEG/KVeibl8JH9MJEnhWMB9cwMbnQnROc72F418R+Ic8QPXg
4t4tgKWYWR+vS2Gx+FOvIat68siUjsU8G9jvs3wqKbTzuicDEFCDoK9MYQRdcV6Z
fluIN4qFb3z0tJihq9WrZlkiARPe5cf8or1aynDpPNSxmMnJV+wv5xnbqx7kPOcE
cuqhmy3SUn40jbIFPzuXmnypn1MDS9RxU6T2w/o3EU71h+w5ImLE86MlTEQPVmJJ
fapPvjPSqe6iNA7o4sXZ9dfodZtfP9v6fxuoUqfoYRRTIoYECYk2MzhEUfxe64VE
f17H0suurHhXuBDF5Q3k6yO5zoijwq7A3sGv9Kgq6lPuBgKWYqJY14t7YVx81Myi
yUbAfXqErypxvCgrX2/AO/ItEPK5DlDK555DbWjd01Jnfy2ckae7W6lBulfYgMNG
SP6j1KdgM+aH4Av2JxgBxPXoBnUzGZYnEbc4iy/17GzQruAmU0q59wm4XhzC/84W
5m9Ti+tDODPGqJpYFytB11z9X8Jtj9zK0F4T/+QHQO/BJbWLZzbYWrd3jslOIb1W
iGD5h8KmNhjoS3LLutKE
=HbXq
—–END PGP SIGNATURE—–

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Security-announce@lists.apple.com)