CVE-2016-1776
Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request.
Date published : 2016-03-23
http://lists.apple.com/archives/security-announce/2016/Mar/msg00006.html