Skip to main content

Numeric Errors

CVE-2011-3607

Medium
4.4/10

Summary

Integer overflow in the "ap_pregsub" function in 'server/util.c' in the Apache HTTP Server in versions 2.0.35 through 2.0.64, and 2.2.0 through 2.2.21 when the 'mod_setenvif' module is enabled, allows local users to gain privileges via a ".htaccess" file with a crafted 'SetEnvIf' directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

  • MEDIUM
  • LOCAL
  • NONE
  • PARTIAL
  • PARTIAL
  • PARTIAL

CWE-189 - Numeric Errors

Weaknesses in this category are related to improper calculation or conversion of numbers.

References

Advisory Timeline

  • Published