CVE-2016-4975

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.31 Apache HTTP Server versions 2.4.1 through 2.4.23

Description The issue allows for possible CRLF injection, enabling HTTP response splitting attacks for sites using mod userdir. This was mitigated by changes in versions 2.4.25 and 2.2.32, which prohibit CR or LF injection into the "Location" or other outbound header key or value.

Recommendations For Apache HTTP Server versions 2.2.0 through 2.2.31, update to version 2.2.32 to resolve the issue. For Apache HTTP Server versions 2.4.1 through 2.4.23, update to version 2.4.25 to resolve the issue.