CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
97.3%
CentOS Errata and Security Advisory CESA-2009:1107
apr-util is a utility library used with the Apache Portable Runtime (APR).
It aims to provide a free library of C data structures and routines. This
library contains additional utility interfaces for APR; including support
for XML, LDAP, database interfaces, URI parsing, and more.
An off-by-one overflow flaw was found in the way apr-util processed a
variable list of arguments. An attacker could provide a specially-crafted
string as input for the formatted output conversion routine, which could,
on big-endian platforms, potentially lead to the disclosure of sensitive
information or a denial of service (application crash). (CVE-2009-1956)
Note: The CVE-2009-1956 flaw only affects big-endian platforms, such as the
IBM S/390 and PowerPC. It does not affect users using the apr-util package
on little-endian platforms, due to their different organization of byte
ordering used to represent particular data.
A denial of service flaw was found in the apr-util Extensible Markup
Language (XML) parser. A remote attacker could create a specially-crafted
XML document that would cause excessive memory consumption when processed
by the XML decoding engine. (CVE-2009-1955)
A heap-based underwrite flaw was found in the way apr-util created compiled
forms of particular search patterns. An attacker could formulate a
specially-crafted search keyword, that would overwrite arbitrary heap
memory locations when processed by the pattern preparation engine.
(CVE-2009-0023)
All apr-util users should upgrade to these updated packages, which contain
backported patches to correct these issues. Applications using the Apache
Portable Runtime library, such as httpd, must be restarted for this update
to take effect.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-June/078145.html
https://lists.centos.org/pipermail/centos-announce/2009-June/078146.html
Affected packages:
apr-util
apr-util-devel
apr-util-docs
Upstream details at:
https://access.redhat.com/errata/RHSA-2009:1107
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | apr-util | < 1.2.7-7.el5_3.1 | apr-util-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util-devel | < 1.2.7-7.el5_3.1 | apr-util-devel-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util-docs | < 1.2.7-7.el5_3.1 | apr-util-docs-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util | < 1.2.7-7.el5_3.1 | apr-util-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util-devel | < 1.2.7-7.el5_3.1 | apr-util-devel-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util-docs | < 1.2.7-7.el5_3.1 | apr-util-docs-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | i386 | apr-util | < 1.2.7-7.el5_3.1 | apr-util-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | x86_64 | apr-util | < 1.2.7-7.el5_3.1 | apr-util-1.2.7-7.el5_3.1.x86_64.rpm |
CentOS | 5 | i386 | apr-util-devel | < 1.2.7-7.el5_3.1 | apr-util-devel-1.2.7-7.el5_3.1.i386.rpm |
CentOS | 5 | x86_64 | apr-util-devel | < 1.2.7-7.el5_3.1 | apr-util-devel-1.2.7-7.el5_3.1.x86_64.rpm |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
97.3%