Back to search

Apache httpd APR apr_palloc heap overflow (CVE-2009-2412)

Severity CVSS Published Added Modified
10 (AV:N/AC:L/Au:N/C:C/I:C/A:C) August 05, 2009 June 29, 2010 February 12, 2015


The affected asset is vulnerable to this Apache vulnerability ONLY if a non-Apache application can be passed unsanitized user-provided sizes to the apr_palloc() function. Review your Web server configuration for validation.

A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way.

Free Nexpose Download

Discover, prioritize, and remediate security risks today!

 Download now


Related Vulnerabilities