| Package | Affected versions | Patched versions |
|---|---|---|
| http server | = 2.0= 2.0.28= 2.0.32= 2.0.34= 2.0.35= 2.0.36= 2.0.37= 2.0.38= 2.0.39= 2.0.40= 2.0.41= 2.0.42= 2.0.43= 2.0.44= 2.0.45= 2.0.46= 2.0.47= 2.0.48= 2.0.49= 2.0.50= 2.0.51= 2.0.52= 2.0.53= 2.0.54= 2.0.55= 2.0.56= 2.0.57= 2.0.58= 2.0.59= 2.0.60= 2.0.61= 2.0.63= 2.0.64= 2.0.9= 2.2.0= 2.2.1= 2.2.10= 2.2.11= 2.2.12= 2.2.13= 2.2.14= 2.2.15= 2.2.16= 2.2.18= 2.2.19= 2.2.2= 2.2.20= 2.2.21= 2.2.3= 2.2.4= 2.2.6= 2.2.8= 2.2.9 |
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free