--- httpd-2.0.52/modules/mappers/mod_imap.c.cve3352 +++ httpd-2.0.52/modules/mappers/mod_imap.c @@ -341,7 +341,7 @@ if (!strcasecmp(value, "referer")) { referer = apr_table_get(r->headers_in, "Referer"); if (referer && *referer) { - return apr_pstrdup(r->pool, referer); + return ap_escape_html(r->pool, referer); } else { /* XXX: This used to do *value = '\0'; ... which is totally bogus --- httpd-2.0.52/server/util.c.cve3352 +++ httpd-2.0.52/server/util.c @@ -1761,6 +1761,8 @@ j += 3; else if (s[i] == '&') j += 4; + else if (s[i] == '"') + j += 5; if (j == 0) return apr_pstrmemdup(p, s, i); @@ -1779,6 +1781,10 @@ memcpy(&x[j], "&", 5); j += 4; } + else if (s[i] == '"') { + memcpy(&x[j], """, 6); + j += 5; + } else x[j] = s[i];