Cross-Site Scripting Vulnerability in Apache mod_imap Module

A cross-site scripting (XSS) vulnerability has been discovered in the Apache httpd server’s mod_imap module which allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.

Input passed to the image map “Referer” directive in “mod_imap” isn’t properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

The vulnerability has been reported in versions 1.3.0 through 1.3.34, and versions 2.0.35 through 2.0.55.

The vulnerability has been fixed in version 1.3.35-dev, and 2.0.56-dev.

Link

It affects pretty much all platforms as far as I could check.