Description
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.8-1 | — |
| Debian 13 | apache2 | 2.2.8-1 | — |
| Debian 12 | apache2 | 2.2.8-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | httpd +2 | 2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 5 | mod_ssl | 1:2.2.3-11.el5_1.3 | RHSA-2008:0008 |
| RHEL 4 | httpd +3 | 2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 4 | mod_ssl | 1:2.0.52-38.ent.2 | RHSA-2008:0006 |
| RHEL 3 | httpd +1 | 2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 3 | mod_ssl | 1:2.0.46-70.ent | RHSA-2008:0005 |
| RHEL 2 | apache +2 | 1.3.27-14.ent | RHSA-2008:0004 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.4-9.el5s2 | RHSA-2008:0009 |
| Red Hat Rhel Application Stack 1 | httpd +2 | 2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Rhel Application Stack 1 | mod_ssl | 1:2.0.59-1.el4s1.10 | RHSA-2008:0007 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
| Red Hat Network Proxy 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0263 |
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Advisories 12
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0008 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0006 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0004 Red Hat Security Advisory: apache security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0005 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0263 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0009 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0007 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2008:0005 vendor-advisory
- ADV-2008-0178 vdb-entry
- 1019093 vdb-entry
- 28922 third-party-advisory
- 39134 vdb-entry
- 28749 third-party-advisory
- SSA:2008-045-02 vendor-advisory
- 29988 third-party-advisory
- apache-modimap-xss(39001) vdb-entry
- SSRT090208 vendor-advisory
- 28375 third-party-advisory
- 28750 third-party-advisory
- ADV-2008-1623 vdb-entry
- 29806 third-party-advisory
- apache-modimagemap-xss(39002) vdb-entry
- 20080716 rPSA-2008-0035-1 httpd mod_ssl mailing-list
- FEDORA-2008-1695 vendor-advisory
- PK58024 vendor-advisory
- 28046 third-party-advisory
- 28526 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
- RHSA-2008:0006 vendor-advisory
- 31142 third-party-advisory
- ADV-2008-0924 vdb-entry
- 233623 vendor-advisory
- RHSA-2008:0007 vendor-advisory
- http://httpd.apache.org/security/vulnerabilities_20.html
- TA08-150A third-party-advisory
- RHSA-2008:0008 vendor-advisory
- FEDORA-2008-1711 vendor-advisory
- ADV-2008-0084 vdb-entry
- ADV-2007-4301 vdb-entry
- ADV-2008-0398 vdb-entry
- RHSA-2008:0009 vendor-advisory
- MDVSA-2008:014 vendor-advisory
- 26838 vdb-entry
- 29420 third-party-advisory
- http://httpd.apache.org/security/vulnerabilities_22.html
- APPLE-SA-2008-03-18 vendor-advisory
- 30430 third-party-advisory
- oval:org.mitre.oval:def:9539 vdb-entry signature
- APPLE-SA-2008-05-28 vendor-advisory
- 28525 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm
- ADV-2008-0809 vdb-entry
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28081 third-party-advisory
- 28467 third-party-advisory
- SSRT080059 vendor-advisory
- PK65782 vendor-advisory
- 28196 third-party-advisory
- RHSA-2008:0004 vendor-advisory
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 28607 third-party-advisory
- SUSE-SA:2008:021 vendor-advisory
- 30356 third-party-advisory
- http://httpd.apache.org/security/vulnerabilities_13.html
- PK63273 vendor-advisory
- MDVSA-2008:015 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307562