Description
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Portable Runtime | 1.6.2 and prior | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apr | 1.6.3-1 | — |
| Debian 13 | apr | 1.6.3-1 | — |
| Debian 12 | apr | 1.6.3-1 | — |
| Debian 9 | apr | 1.5.2-5+deb9u1 | DLA-2897-1 |
| Debian 7 | apr | 1.4.6-3+deb7u2 | DLA-1162-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apr | 1.5.2-3ubuntu0.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | apr | 1.5.0-1ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | apr +1 | 1.4.8-3.el7_4.1 | RHSA-2017:3270 |
| RHEL 6 | apr +1 | 1.3.9-5.el6_9.1 | RHSA-2017:3270 |
| RHEL 3 | httpd24-apr +1 | 1.5.1-1.el6.1 | RHSA-2018:0316 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.3 EUS | apr +1 | 1.4.8-3.el7_3.1 | RHSA-2018:1253 |
| RHEL 7.2 TUS | apr +1 | 1.4.8-3.el7_2.1 | RHSA-2018:1253 |
| RHEL 7.2 E4S | apr +1 | 1.4.8-3.el7_2.1 | RHSA-2018:1253 |
| RHEL 7.2 AUS | apr +1 | 1.4.8-3.el7_2.1 | RHSA-2018:1253 |
| RHEL 6.7 EUS | apr +1 | 1.3.9-5.el6_7.1 | RHSA-2018:1253 |
| RHEL 6.6 TUS | apr +1 | 1.3.9-5.el6_6.1 | RHSA-2018:1253 |
| RHEL 6.6 AUS | apr +1 | 1.3.9-5.el6_6.1 | RHSA-2018:1253 |
| RHEL 6.5 AUS | apr +1 | 1.3.9-5.el6_5.1 | RHSA-2018:1253 |
| RHEL 6.4 AUS | apr +1 | 1.3.9-5.el6_4.1 | RHSA-2018:1253 |
| Red Hat JBoss Web Server 3 | mod_cluster +2 | 1.3.8-2.Final_redhat_2.1.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-11.redhat_11.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat-vault +2 | 1.1.6-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-25.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-29.ep7.el6 | RHSA-2018:0466 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +7 | 2.4.23-125.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_bmx | 0.9.6-15.GA.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.8-1.Final_redhat_1.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.23-125.jbcs.el6 | RHSA-2017:3477, RHSA-2017:3476 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | libapr1 | 1.6.5-4.13.1 | SUSE-SU-2026:4927-1 |
| SLES 12 SP5 | libtcnative-1-0 | 1.3.9-3.9.1 | SUSE-SU-2026:4927-1 |
| SLES 12 SP5 | tomcat | 9.0.123-3.182.2 | SUSE-SU-2026:4927-1 |
| SLES 12 SP3 | libapr1 | 1.5.1-4.3.1 | SUSE-SU-2018:1196-1 |
| SLES 11 SP4 | libapr1 | 1.3.3-11.18.19.13.2 | SUSE-SU-2018:1322-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Studio Onsite 1.3 | libapr1 | 1.3.3-11.18.19.13.2 | SUSE-SU-2018:1322-1 |
| SLES for SAP 12 SP3 | libapr1 | 1.5.1-4.3.1 | SUSE-SU-2018:1196-1 |
| SLES for SAP 11 SP4 | libapr1 | 1.3.3-11.18.19.13.2 | SUSE-SU-2018:1322-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | apr +1 | 1.4.8-3.el7_4.1 | ELSA-2017-3270 |
Advisories 14
- SUSE-SU-2026:4927-1 Security update for libapr1, libtcnative-1-0, tomcat SUSE / openSUSE Security Updates · Oct 31, 2026
- RHSA-2018:1253 Red Hat Security Advisory: apr security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2018:0466 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2018:0316 Red Hat Security Advisory: httpd24-apr security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3477 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3476 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:3270 Red Hat Security Advisory: apr security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- DLA-2897-1 apr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1162-1 apr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:1322-1 Security update for libapr1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1196-1 Security update for libapr1 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- WID-SEC-2023-1594 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023
- ELSA-2017-3270 Important: apr security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 28, 2017
References
- [debian-lts-announce] 20171106 [SECURITY] [DLA 1162-1] apr security update mailing-list
- RHSA-2018:0316 vendor-advisory
- https://svn.apache.org/viewvc?view=revision&revision=1807976
- 1042004 vdb-entry
- RHSA-2017:3475 vendor-advisory
- RHSA-2018:0465 vendor-advisory
- http://www.apache.org/dist/apr/Announcement1.x.html
- RHSA-2017:3270 vendor-advisory
- [announce] 20171023 Apache Portable Runtime APR 1.6.3, APR-util 1.6.1 and APR-iconv 1.2.2 Released mailing-list
- RHSA-2017:3476 vendor-advisory
- RHSA-2018:1253 vendor-advisory
- RHSA-2017:3477 vendor-advisory
- RHSA-2018:0466 vendor-advisory
- 101560 vdb-entry
- [apr-commits] 20210816 svn commit: r1892358 - /apr/apr/branches/1.7.x/CHANGES mailing-list
- [apr-commits] 20210820 svn commit: r49582 - /release/apr/patches/apr-1.7.0-CVE-2021-35940.patch mailing-list
- [apr-dev] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [oss-security] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [announce] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [apr-dev] 20210916 Re: CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [debian-lts-announce] 20220124 [SECURITY] [DLA 2897-1] apr security update mailing-list