Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | apr-util | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-debugsource | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-devel | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-ldap | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-ldap-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-mysql | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-mysql-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-odbc | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-odbc-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-openssl | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-openssl-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-pgsql | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-pgsql-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-sqlite | 0:1.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-sqlite-debuginfo | 0:1.6.3-1.amzn2023.0.1 |
Vulnerabilities 1
-
Unscored —
Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-25147.html