Summary
Thomas Stangner discovered a permission vulnerability in the Apache
Portable Runtime (APR) library. A local attacker could possibly use this
issue to read named shared memory segments, potentially exposing sensitive
application data.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | apr | 1.6.5-1ubuntu1.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | apr | 1.7.0-8ubuntu0.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | apr | 1.7.2-3.1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | apr | 1.5.2-3ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | apr | 1.6.3-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 5.5
Apache Portable Runtime (APR): Unexpected lax shared memory permissions
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with A…
References
-
report
https://ubuntu.com/security/CVE-2023-49582