Arkadi Vainbrand

A heap buffer overflow occurs in the `convert fname()` function within src/url.c. This issue is triggered when a server-supplied filename requires character set conversion and the output buffer is too small during iconv E2BIG reallocation. The reallocation logic miscalculates the remaining space, allowing a remote attacker to cause memory corruption via a maliciously crafted server response. iconv E2BIG is an error code indicating that the output buffer is too small to hold the converted string.

A flaw exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is performed in clear-text via IMAP, SMTP, or POP3, a subsequent request to the same host bypasses the TLS requirement and transmits data unencrypted.

A NULL pointer dereference in the mod authn socache module allows an unauthenticated remote user to crash a child process when a caching forward proxy configuration is used. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to a program crash.

A heap-based buffer overflow occurs when interacting with malicious backend servers using `ProxyPassReverseCookie*`. A heap-based buffer overflow is a memory corruption issue where data exceeds the allocated boundary of a buffer on the heap, potentially leading to crashes or arbitrary code execution.