Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to Apache HTTPD version 2.0.64Upgrade to Apache HTTPD version 2.2.13 | Apr 12, 2012 | Aug 6, 2009 |
| Apple Osx Apacheportableruntime | — | Upgrade macOS to the latest versionApply OS X security update 2009-006 | Dec 16, 2011 | Aug 6, 2009 |
| Centos_linux | — | Upgrade apr-docsUpgrade apr-utilUpgrade aprUpgrade apr-util-develUpgrade apr-util-docsUpgrade apr-devel | Dec 1, 2016 | Aug 6, 2009 |
| Debian | — | Upgrade aprUpgrade apr-util | Jul 30, 2024 | Aug 6, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/apr-util.Upgrade dev-libs/apr. | Oct 30, 2017 | Aug 6, 2009 |
| Oracle_linux | — | Upgrade apr-utilUpgrade apr-util-docsUpgrade apr-util-develUpgrade apr-docsUpgrade apr-develUpgrade apr | Oct 16, 2024 | Aug 6, 2009 |
| Suse | — | Upgrade libapr-util1-dbd-pgsqlUpgrade libapr1Upgrade apache2-utilsUpgrade apache2-docUpgrade libapr1-devel-32bitUpgrade apache2-example-pagesUpgrade apache2-eventUpgrade libapr-util1Upgrade libapr-util1-dbd-mysqlUpgrade libapr-util1-32bitUpgrade libapr1-0Upgrade libapr1-32bitUpgrade apache2-workerUpgrade apache2-preforkUpgrade apr-develUpgrade apache2Upgrade libapr1-develUpgrade libapr-util1-develUpgrade apache2-manualUpgrade libapr-util1-0-dbd-sqlite3Upgrade apache2-develUpgrade apr-util-develUpgrade libapr-util1-devel-32bitUpgrade libapr-util1-0-dbd-mysqlUpgrade libapr-util1-0Upgrade libapr-util1-dbd-sqlite3Upgrade libapr-util1-0-dbd-pgsql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libapr1Upgrade libaprutil1Upgrade libapr0 | Nov 8, 2024 | Aug 6, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub