Summary
Ronald Crane discovered that APR-util did not properly handled memory when
encoding or decoding certain input data. An attacker could possibly use
this issue to cause a denial of service, or possibly execute arbitrary
code.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | apr-util | 1.6.1-2ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | apr-util | 1.6.1-4ubuntu2.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | apr-util | 1.6.1-5ubuntu4.22.04.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | apr-util | 1.5.3-1ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | apr-util | 1.5.4-1ubuntu0.1~esm2 |
Vulnerabilities 1
-
Unscored —
Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
References
-
report
https://ubuntu.com/security/CVE-2022-25147