Two vulnerabilities have been reported in Apache HTTP Server, which can be exploited by malicious people to disclose certain sensitive information and conduct cross-site scripting attacks.

1) An error within the mod_proxy_ajp and mod_proxy_http modules does not properly close the connection to the back end server when handling errors. This can be exploited to disclose certain response data of a different user via specially crafted HTTP requests.

2) Certain input passed via filenames when handling untrusted uploads is not properly sanitised in the mod_negotiation module before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 2.4.3.

Solution
Update to version 2.4.3.

Provided and/or discovered by
1) Yap Sok Ann in a bug report
2) Reported by the vendor

Original Advisory
http://httpd.apache.org/security/vulnerabilities_24.html
http://www.apache.org/dist/httpd/CHANGES_2.4.3

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers