Description
Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.0.55-4 | — |
| Debian 13 | apache2 | 2.0.55-4 | — |
| Debian 12 | apache2 | 2.0.55-4 | — |
| Debian 3.1 | apache | 1.3.33-6sarge3 | DSA-1167-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | httpd +3 | 2.0.52-22.ent | RHSA-2006:0159 |
| RHEL 4 | mod_ssl | 1:2.0.52-22.ent | RHSA-2006:0159 |
| RHEL 3 | httpd +1 | 2.0.46-56.ent | RHSA-2006:0159 |
| RHEL 3 | mod_ssl | 1:2.0.46-56.ent | RHSA-2006:0159 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Advisories 4
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2006:0159 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1167-1 apache - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 17319 third-party-advisory
- ADV-2006-3995 vdb-entry
- 18526 third-party-advisory
- 20046 third-party-advisory
- 102662 vendor-advisory
- 1015344 vdb-entry
- SSRT071293 vendor-advisory
- DSA-1167 vendor-advisory
- 18339 third-party-advisory
- SSRT061265 vendor-advisory
- ADV-2006-4300 vdb-entry
- 21744 third-party-advisory
- SUSE-SR:2006:004 vendor-advisory
- 18340 third-party-advisory
- ADV-2008-1246 vdb-entry
- SSRT061269 vendor-advisory
- 20670 third-party-advisory
- SSRT090208 vendor-advisory
- 23260 third-party-advisory
- RHSA-2006:0159 vendor-advisory
- 18008 third-party-advisory
- SUSE-SA:2006:043 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- ADV-2006-2423 vdb-entry
- ADV-2008-0924 vdb-entry
- MDKSA-2006:007 vendor-advisory
- 29849 third-party-advisory
- 18333 third-party-advisory
- ADV-2006-4015 vdb-entry
- USN-241-1 vendor-advisory
- TA08-150A third-party-advisory
- OpenPKG-SA-2005.029 vendor-advisory
- 22368 third-party-advisory
- HPSBUX02145 vendor-advisory
- 102663 vendor-advisory
- RHSA-2006:0158 vendor-advisory
- 29420 third-party-advisory
- FLSA-2006:175406 vendor-advisory
- FEDORA-2006-052 vendor-advisory
- SUSE-SR:2007:011 vendor-advisory
- ADV-2006-4868 vdb-entry
- APPLE-SA-2008-03-18 vendor-advisory
- 30430 third-party-advisory
- APPLE-SA-2008-05-28 vendor-advisory
- http://issues.apache.org/bugzilla/show_bug.cgi?id=37874
- 18517 third-party-advisory
- 22669 third-party-advisory
- TSLSA-2005-0074 vendor-advisory
- SSA:2006-129-01 vendor-advisory
- PK16139 vendor-advisory
- oval:org.mitre.oval:def:10480 vdb-entry signature
- RHSA-2006:0692 vendor-advisory
- 18585 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- PK25355 vendor-advisory
- GLSA-200602-03 vendor-advisory
- ADV-2008-1697 vdb-entry
- 19012 third-party-advisory
- 18429 third-party-advisory
- 15834 vdb-entry