CVE-2011-3607: apache http_server Numeric Errors
Vulnerability summary
CVE-2011-3607 is a medium (CVSS 4.4) Numeric Errors vulnerability in apache http_server. EPSS estimates a 4.72% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 08-11-2011PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.72%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.72% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (bugs.launchpad.net)
Maturity: unknown
Exploit Reference (halfdog.net)
Maturity: unknown
Exploit Reference (halfdog.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Apache1 product
- http_serverEOL2.0 | 2.0.9 | 2.0.28 | 2.0.28:beta | 2.0.32 | 2.0.32:beta | 2.0.34:beta | 2.0.35 | 2.0.36 | 2.0.37 | 2.0.38 | 2.0.39 | 2.0.40 | 2.0.41 | 2.0.42 | 2.0.43 | 2.0.44 | 2.0.45 | 2.0.46 | 2.0.47 | 2.0.48 | 2.0.49 | 2.0.50 | 2.0.51 | 2.0.52 | 2.0.53 | 2.0.54 | 2.0.55 | 2.0.56 | 2.0.57 | 2.0.58 | 2.0.59 | 2.0.60 | 2.0.61 | 2.0.63 | 2.0.64 | 2.2.0 | 2.2.1 | 2.2.2 | 2.2.3 | 2.2.4 | 2.2.6 | 2.2.8 | 2.2.9 | 2.2.10 | 2.2.11 | 2.2.12 | 2.2.13 | 2.2.14 | 2.2.15 | 2.2.16 | 2.2.18 | 2.2.19 | 2.2.20 | 2.2.21
Debian1 product
- apache2< 2.2.21-4
2 vendors · 2 products
References
49 links- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041Vendor AdvisoryX Refsource HP
- www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.htmlX Refsource MISCExploit
- bugzilla.redhat.com/show_bug.cgi?id=750935X Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRM
Show all 49 references
- support.apple.com/kb/HT5501X Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/cpujul2012-392727.htmlX Refsource CONFIRM
