Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the referenced advisories for more information.

Sun Solaris 10.0

Sun 122911-02
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -122911-02-1

Sun Solaris 8

Sun 116973-05
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116973-05-1

Sun Solaris 10

Sun 120543-06
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120543-06-1

HP Webproxy A.02.10

HP PHSS_35437
HP-UX B.11.04 HP Webproxy A.02.10 (Apache 2.x)
http://itrc.hp.com/

Apache Software Foundation Apache 1.3.26

Slackware apache-1.3.35-i386-1_slack8.1.tgz
Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/a pache-1.3.35-i386-1_slack8.1.tgz

Apache Software Foundation Apache 1.3.27

Slackware apache-1.3.35-i386-1_slack9.0.tgz
Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/a pache-1.3.35-i386-1_slack9.0.tgz

Apache Software Foundation Apache 1.3.28

Slackware apache-1.3.35-i486-1_slack9.1.tgz
Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/a pache-1.3.35-i486-1_slack9.1.tgz

Apache Software Foundation Apache 1.3.31

Slackware apache-1.3.35-i486-1_slack10.0.tgz
Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ apache-1.3.35-i486-1_slack10.0.tgz

Ubuntu apache-common_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_amd64.deb

Ubuntu apache-common_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_i386.deb

Ubuntu apache-common_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_powerpc.deb

Ubuntu apache-dbg_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_amd64.deb

Ubuntu apache-dbg_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_i386.deb

Ubuntu apache-dbg_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_powerpc.deb

Ubuntu apache-dev_1.3.31-6ubuntu0.9_all.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-dev_1.3.31 -6ubuntu0.9_all.deb

Ubuntu apache-doc_1.3.31-6ubuntu0.9_all.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-doc_1. 3.31-6ubuntu0.9_all.deb

Ubuntu apache-perl_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_amd64.deb

Ubuntu apache-perl_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_i386.deb

Ubuntu apache-perl_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_powerpc.deb

Ubuntu apache-ssl_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_amd64.deb

Ubuntu apache-ssl_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_i386.deb

Ubuntu apache-ssl_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_powerpc.deb

Ubuntu apache-utils_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_amd64.deb

Ubuntu apache-utils_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_i386.deb

Ubuntu apache-utils_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_powerpc.deb

Ubuntu apache_1.3.31-6ubuntu0.9_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_amd64.deb

Ubuntu apache_1.3.31-6ubuntu0.9_i386.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_i386.deb

Ubuntu apache_1.3.31-6ubuntu0.9_powerpc.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_powerpc.deb

Ubuntu apache2-common_2.0.50-12ubuntu4.10_amd64.deb
Ubuntu 4.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.50-12ubuntu4.10_amd64.deb

Apple Mac OS X 10.4.11

Apple SecUpd2008-002PPC.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002PPC.dmg

Apple SecUpd2008-002Univ.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002Univ.dmg

Apple Security Update 2008-003 (Intel)
http://www.apple.com/support/downloads/securityupdate2008003intel.html

Apple Security Update 2008-003 (PPC)
http://www.apple.com/support/downloads/securityupdate2008003ppc.html

Apple Mac OS X Server 10.4.11

Apple SecUpdSrvr2008-002PPC.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002PPC.dmg

Apple SecUpdSrvr2008-002Univ.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002Univ.dmg

Apple Security Update 2008-003 Server (PPC)
http://www.apple.com/support/downloads/securityupdate2008003serverppc. html

Apple Security Update 2008-003 Server (Universal)
http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html

Apache Software Foundation Apache 2.0.40

RedHat httpd-2.0.40-21.21.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-2.0.40-21 .21.legacy.i386.rpm

RedHat httpd-devel-2.0.40-21.21.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-devel-2.0 .40-21.21.legacy.i386.rpm

RedHat httpd-manual-2.0.40-21.21.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-manual-2. 0.40-21.21.legacy.i386.rpm

RedHat mod_ssl-2.0.40-21.21.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/mod_ssl-2.0.40- 21.21.legacy.i386.rpm

Apache Software Foundation Apache 2.0.54

Mandriva apache-base-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-base-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-devel-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-devel-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_cache-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_cache-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_dav-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_dav-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_deflate-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_deflate-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_disk_cache-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_disk_cache-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_file_cache-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_file_cache-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_ldap-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_ldap-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_mem_cache-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_mem_cache-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_proxy-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_proxy-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_userdir-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mod_userdir-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-modules-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-modules-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-peruser-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-peruser-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-prefork-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-prefork-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-worker-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-mpm-worker-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-source-2.0.54-13.2.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/

Mandriva apache-source-2.0.54-13.2.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/

Ubuntu apache2-common_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_amd64.deb

Ubuntu apache2-common_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_i386.deb

Ubuntu apache2-common_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-doc_2.0.54-5ubuntu4_all.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 54-5ubuntu4_all.deb

Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_amd64.deb

Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_i386.deb

Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_amd64.deb

Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_i386.deb

Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-mpm-threadpool_2.0.54-5ubuntu4_all.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-thre adpool_2.0.54-5ubuntu4_all.deb

Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_amd64.deb

Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_i386.deb

Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_amd64.deb

Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_i386.deb

Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_amd64.deb

Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_i386.deb

Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_powerpc.deb

Ubuntu apache2-utils_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_amd64.deb

Ubuntu apache2-utils_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_i386.deb

Ubuntu apache2-utils_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_powerpc.deb

Ubuntu apache2_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_amd64.deb

Ubuntu apache2_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_i386.deb

Ubuntu apache2_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_powerpc.deb

Ubuntu libapr0-dev_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_amd64.deb

Ubuntu libapr0-dev_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_i386.deb

Ubuntu libapr0-dev_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_powerpc.deb

Ubuntu libapr0_2.0.54-5ubuntu4_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_amd64.deb

Ubuntu libapr0_2.0.54-5ubuntu4_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_i386.deb

Ubuntu libapr0_2.0.54-5ubuntu4_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_powerpc.deb

mod_ssl mod_ssl 2.8.24

Slackware mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz
Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz