My website was scanned for PCI-compliance. Vulnerabilities found:
Apache HTTP Server Zero-Length Directory Name in LD_LIBRARY_PATH Vulnerability, CVE-2012-0883 Apache HTTP Server mod_rewrite Terminal Escape Sequence Vulnerability, CVE-2013-1862 Apache HTTP Server XSS Vulnerabilities via Hostnames, CVE-2012-3499 CVE-2012-4558
The site is running on apache2 (2.2.22-1ubuntu1.4) on Ubuntu 12.04 LTS. 'apt-get upgrade' says that it's already the latest version.
I found http://ubuntuforums.org/showthread.php?t=2011603 and upgraded apache2 to 2.4. But after upgrade, apache2 didn't start and gave me horrible errors. So I removed it and reinstalled apache2 2.2.22.
I googled for this issue and found some pages mentioning patch but I didn't understand them. My server management skill is very limited.
Can you help me with this problem? What's the easiest way to make apache2 PCI-compliant in my situation?