Published: 06/08/2009 Updated: 07/11/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote malicious users to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache apr-util 1.3.6-dev
apache portable runtime 1.3.6-dev
apache portable runtime 1.3.7
apache apr-util 1.3.6
apache apr-util 0.9.2-dev
apache apr-util 1.3.3
apache apr-util 0.9.9
apache portable runtime 0.9.7-dev
apache portable runtime 1.3.3
apache portable runtime 0.9.6
apache portable runtime 0.9.16-dev
apache portable runtime 0.9.8
apache portable runtime 1.3.1
apache portable runtime 1.3.2
apache portable runtime 1.3.4
apache apr-util 1.3.0
apache apr-util 1.3.4
apache apr-util 0.9.4
apache portable runtime 0.9.4
apache apr-util 0.9.3
apache portable runtime 0.9.3
apache apr-util 0.9.7-dev
apache portable runtime 0.9.1
apache portable runtime 0.9.5
apache apr-util 0.9.3-dev
apache portable runtime 1.3.8
apache apr-util 0.9.1
apache apr-util 0.9.6
apache apr-util 1.3.1
apache apr-util 1.3.5
apache apr-util 0.9.2
apache apr-util 1.3.2
apache apr-util 1.3.4-dev
apache portable runtime 0.9.7
apache portable runtime 0.9.2-dev
apache apr-util 1.3.7
apache portable runtime 0.9.2
apache portable runtime 1.3.6
apache portable runtime 0.9.9
apache apr-util 0.9.8
apache portable runtime 1.3.5
apache apr-util 0.9.16
apache portable runtime 0.9.3-dev
apache portable runtime 1.3.4-dev
apache portable runtime 1.3.0
apache apr-util 1.3.8
apache apr-util 0.9.5

Synopsis Moderate: apr and apr-util security update Type/Severity Security Advisory: Moderate Topic Updated apr and apr-util packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security R ...

Matt Lewis discovered that the memory management code in the Apache Portable Runtime (APR) library does not guard against a wrap-around during size computations This could cause the library to return a memory area which smaller than requested, resulting a heap overflow and possibly arbitrary code execution For the old stable distribution (etch), ...

USN-813-1 fixed vulnerabilities in apr This update provides the corresponding updates for apr as provided by Apache on Ubuntu 606 LTS ...

USN-813-1 fixed vulnerabilities in apr This update provides the corresponding updates for apr-util ...

Matt Lewis discovered that apr did not properly sanitize its input when allocating memory If an application using apr processed crafted input, a remote attacker could cause a denial of service or potentially execute arbitrary code as the user invoking the application ...

Get Started

CVE-2009-2412

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect