DEBIAN-CVE-2006-3918

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2006-3918
Downstream
DSA-1167-1
Published: 28 Jul 2006, 00:04
Last modified:28 Apr 2026, 20:08

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Jul 2006, 00:04
Published
Vulnerability first disclosed
28 Apr 2026, 20:08
Last Modified
Vulnerability information updated

Description

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

Affected Systems

  • debian•apache2

    < 2.0.55-4.1 | < 2.0.55-4.1 | < 2.0.55-4.1 | < 2.0.55-4.1

References (1)