Apache Software Foundation Apache Portable Runtime vulnerabilities
5 known vulnerabilities affecting apache_software_foundation/apache_portable_runtime.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH1MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2022-24963P3CRITICALCVSS 9.8v1.7.02023-01-31
CVE-2022-24963 [CRITICAL] CWE-190 CVE-2022-24963: Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime (APR) version 1.7.0.
nvd
CVE-2022-28331P3CRITICALCVSS 9.8≤ 1.7.02023-01-31
CVE-2022-28331 [CRITICAL] CWE-190 CVE-2022-28331: On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buff
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
nvd
CVE-2017-12613P4HIGHCVSS 7.1vApache Portable Runtime 1.7.02017-10-24
CVE-2017-12613 [HIGH] CWE-125 CVE-2017-12613: When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value i
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may rep
nvd
CVE-2023-49582P4MEDIUMCVSS 5.5≥ 0.9.0, ≤ 1.7.42024-08-26
CVE-2023-49582 [MEDIUM] CWE-732 CVE-2023-49582: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)
Users are recommended to upgrade to APR version 1.7.5, which
nvd
CVE-2017-12618P4MEDIUMCVSS 4.7v1.6.0 and prior2017-10-24
CVE-2017-12618 [MEDIUM] CWE-125 CVE-2017-12618: Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM da
Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.
nvd