Description

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Remediation

References

CVE-2006-3747

Related Vulnerabilities

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-7572)

PrestaShop Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-3110)

Ampache Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12386)

WordPress Plugin HTML5 Lyrics Karaoke Player Cross-Site Scripting (1.06)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-39151)

Severity

High

Classification

CVE-2006-3747

Tags

Missing Update Known Vulnerabilities