as explained on :
mod_php should be rebuilt with the latest apache-devel headers, and taking
that php-imap is statically linked to a buggy c-client the new imap-devel
should be used also
at least i can make HORDE/IMP barf when trying to overflow "From:", i
wouldn't like to see what happens with X-Keywords :( if it is explotable
There is now a pending bug-fix errata (4.0.4) which will take care of this.