DEBIAN-CVE-2011-4415
- Source
- https://security-tracker.debian.org/tracker/CVE-2011-4415
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4415.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2011-4415
- Upstream
- Published
- 2011-11-08T11:55:05Z
- Modified
- 2026-09-14T06:47:30Z
- Summary
- [none]
- Details
-
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
- References
Affected packages
Debian:12 / apache2
Package
- Name
- apache2
- Purl
- pkg:deb/debian/apache2?arch=source&distro=bookworm
Debian:13 / apache2
Package
- Name
- apache2
- Purl
- pkg:deb/debian/apache2?arch=source&distro=trixie
Debian:14 / apache2
Package
- Name
- apache2
- Purl
- pkg:deb/debian/apache2?arch=source&distro=forky