Search for packages
| purl | pkg:deb/debian/apr-util@1.3.9%2Bdfsg-5 |
| Next non-vulnerable version | 1.6.1-5+deb11u1 |
| Latest non-vulnerable version | 1.6.1-5+deb11u1 |
| Risk | 3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8d91-nmr2-hbg7
Aliases: CVE-2017-12618 |
apr-util: Out-of-bounds access in corrupted SDBM database |
Affected by 1 other vulnerability. |
|
VCID-ausy-pwgu-yyh8
Aliases: CVE-2022-25147 |
apr-util: out-of-bounds writes in the apr_base64 |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3kyb-4yvt-f7e1 | A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language (XML) parser. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. |
CVE-2009-1955
|
| VCID-7ftk-sajb-akh4 | A heap-based underwrite flaw was found in the way the bundled copy of the APR-util library created compiled forms of particular search patterns. An attacker could formulate a specially-crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine. |
CVE-2009-0023
|
| VCID-pj4f-awuq-73g6 | An off-by-one overflow flaw was found in the way the bundled copy of the APR-util library processed a variable list of arguments. An attacker could provide a specially-crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service. |
CVE-2009-1956
|
| VCID-umuk-3n1q-3qet | A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way. |
CVE-2009-2412
|
| VCID-y8nd-7h3r-7fh5 | A flaw was found in the apr_brigade_split_line() function of the bundled APR-util library, used to process non-SSL requests. A remote attacker could send requests, carefully crafting the timing of individual bytes, which would slowly consume memory, potentially leading to a denial of service. |
CVE-2010-1623
|