CVE-2012-3499

Publication date 26 February 2013

Last updated 24 July 2024

Ubuntu priority

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	12.10 quantal	Fixed 2.2.22-6ubuntu2.2
	12.04 LTS precise	Fixed 2.2.22-1ubuntu1.3
	11.10 oneiric	Fixed 2.2.20-1ubuntu1.4
	10.04 LTS lucid	Fixed 2.2.14-5ubuntu8.11
	8.04 LTS hardy	Fixed 2.2.8-1ubuntu0.25

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: http://svn.apache.org/viewvc?view=revision&revision=1447390 Vendor: http://www.debian.org/security/2013/dsa-2637

References

Related Ubuntu Security Notices (USN)

USN-1765-1
Apache HTTP Server vulnerabilities
18 March 2013

CVE-2012-3499

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references