Apache Portable Runtime (APR) security advisories

Security information for Apache Portable Runtime (APR)

Reporting

Do you want disclose a potential security issue for Apache Portable Runtime (APR)? You can read more about the projects’ security policy on their security page, and email your report to the Apache Security Team.

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

Unexpected lax shared memory permissions

CVE-2023-49582 [CVE] [CVE json] [OSV json]

Last updated: 2024-08-26T14:03:42.543Z

Affected

  • Apache Portable Runtime (APR) from 0.9.0 through 1.7.4

Description

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

References

Credits

  • Thomas Stangner (reporter)

Windows out-of-bounds write in apr_socket_sendv function

CVE-2022-28331 [CVE] [CVE json] [OSV json]

Last updated: 2023-07-07T15:26:37.824Z

Affected

  • Apache Portable Runtime (APR) through 1.7.0

Description

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

References

Credits

  • Ronald Crane (Zippenhop LLC) (finder)

out-of-bounds writes in the apr_base64 family of functions

CVE-2022-25147 [CVE] [CVE json] [OSV json]

Last updated: 2023-01-31T15:54:46.758Z

Affected

  • Apache Portable Runtime Utility (APR-util) through 1.6.1

Description

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer.

This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

References

Credits

  • Ronald Crane (Zippenhop LLC) (reporter)

out-of-bound writes in the apr_encode family of functions

CVE-2022-24963 [CVE] [CVE json] [OSV json]

Last updated: 2023-01-31T15:51:53.920Z

Affected

  • Apache Portable Runtime (APR) at 1.7.0

Description

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime (APR) version 1.7.0.

References

Credits

  • Ronald Crane (Zippenhop LLC) (finder)

Regression of CVE-2017-12613

CVE-2021-35940 [CVE] [CVE json] [OSV json]

Last updated: 2021-10-11T14:15:55.651Z

Affected

  • Apache Portable Runtime (APR) at Apache Portable Runtime 1.7.0

Description

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

References

Credits

  • The Apache Portable Runtime project would like to thank Iveta Cesalova (Red Hat) for reporting this issue.