Index: server/util.c
===================================================================
--- server/util.c	(revision 330526)
+++ server/util.c	(working copy)
@@ -1762,6 +1762,8 @@
             j += 3;
         else if (s[i] == '&')
             j += 4;
+        else if (s[i] == '"')
+            j += 5;
 
     if (j == 0)
         return apr_pstrmemdup(p, s, i);
@@ -1780,6 +1782,10 @@
             memcpy(&x[j], "&", 5);
             j += 4;
         }
+        else if (s[i] == '"') {
+            memcpy(&x[j], """, 6);
+            j += 5;
+        }
         else
             x[j] = s[i];
 
Index: CHANGES
===================================================================
--- CHANGES	(revision 330526)
+++ CHANGES	(working copy)
@@ -1,6 +1,12 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.0.56
 
+  *) SECURITY: CVE-2005-3352 (cve.mitre.org)
+     mod_imap: Escape untrusted referer header before outputting in HTML
+     to avoid potential cross-site scripting.  Change also made to
+     ap_escape_html so we escape quotes.  Reported by JPCERT.
+     [Mark Cox]
+
   *) mod_cgi(d): Remove block on OPTIONS method so that scripts can
      respond to OPTIONS directly rather than via server default.
      [Roy Fielding] PR 15242
Index: modules/mappers/mod_imap.c
===================================================================
--- modules/mappers/mod_imap.c	(revision 330526)
+++ modules/mappers/mod_imap.c	(working copy)
@@ -342,7 +342,7 @@
     if (!strcasecmp(value, "referer")) {
         referer = apr_table_get(r->headers_in, "Referer");
         if (referer && *referer) {
-	    return apr_pstrdup(r->pool, referer);
+	    return ap_escape_html(r->pool, referer);
         }
         else {
 	    /* XXX:  This used to do *value = '\0'; ... which is totally bogus