Oracle Linux: CVE-2022-25147: ELSA-2023-3147: apr-util security update (IMPORTANT) (Multiple Advisories)
Description
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.
Solution(s)
- oracle-linux-upgrade-apr-util
- oracle-linux-upgrade-apr-util-bdb
- oracle-linux-upgrade-apr-util-devel
- oracle-linux-upgrade-apr-util-ldap
- oracle-linux-upgrade-apr-util-mysql
- oracle-linux-upgrade-apr-util-nss
- oracle-linux-upgrade-apr-util-odbc
- oracle-linux-upgrade-apr-util-openssl
- oracle-linux-upgrade-apr-util-pgsql
- oracle-linux-upgrade-apr-util-sqlite
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center