CVE-2011-3607

CVE-2011-3607 describes an integer overflow vulnerability in the ap_pregsub function of Apache HTTP Server versions 2.0.x up to 2.0.64 and 2.2.x up to 2.2.21, specifically when the mod_setenvif module is enabled. This flaw allows a local attacker to gain privileges by exploiting a crafted .htaccess file and HTTP request header, leading to a heap-based buffer overflow. The vulnerability has a CVSS score of 4.4, indicating medium severity with local access, medium attack complexity, and partial impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild, an exploit is publicly available on ExploitDB, though it has received minimal community discussion or media coverage.