When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade apr | Dec 7, 2017 | Oct 23, 2017 |
| Apple Osx Apr | — | Apply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Oct 23, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 24, 2017 |
| Centos_linux | — | Upgrade aprUpgrade apr-debuginfoUpgrade apr-devel | Nov 29, 2017 | Oct 23, 2017 |
| Debian | — | Upgrade apr | Feb 25, 2019 | Oct 23, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 14, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade apr-develUpgrade apr | Dec 4, 2017 | Oct 23, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade aprUpgrade apr-devel | Dec 4, 2017 | Oct 23, 2017 |
| Ibm Http_server | — | Apply IBM HTTP Server Interim Fix PI90598Apply IBM HTTP Server version 9.0.0.7 or laterApply IBM HTTP Server version 8.5.5.14 or laterApply IBM HTTP Server version 8.0.0.15 or later | Jun 22, 2018 | Oct 23, 2017 |
| Oracle Solaris | — | Upgrade library/apr-1 to version 1.7.0-11.4.39.0.1.107.0 on Solaris 11.4Upgrade library/apr-15 to version 1.5.1-0.175.3.34.0.2.0 on Solaris 11.3Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Jul 18, 2018 | Oct 23, 2017 |
| Oracle_linux | — | Upgrade aprUpgrade apr-devel | Nov 29, 2017 | Oct 23, 2017 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 23, 2017 |
| Redhat_linux | — | No solution existsUpgrade aprUpgrade apr-debuginfoUpgrade apr-devel | Nov 29, 2017 | Oct 23, 2017 |
| Suse | — | Upgrade libapr1-32bitUpgrade libapr1Upgrade libapr1-develUpgrade libapr1-devel-32bit | May 10, 2018 | Oct 23, 2017 |
| Ubuntu | — | Upgrade apr (Ubuntu Pro) | Nov 19, 2024 | Oct 24, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub