Description
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)
Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Portable Runtime (APR) | 0.9.0 – ≤ 1.7.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apr | 1.7.5-1 | — |
| Debian 13 | apr | 1.7.5-1 | — |
| Debian 12 | apr | 1.7.2-3+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | apr | 1.7.2-3.1ubuntu0.1 | USN-7038-1 |
| Ubuntu 22.04 LTS | apr | 1.7.0-8ubuntu0.22.04.2 | USN-7038-1 |
| Ubuntu 20.04 LTS | apr | 1.6.5-1ubuntu1.1 | USN-7038-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | apr | 1.6.3-2ubuntu0.1~esm1 | USN-7038-1 |
| Ubuntu Pro 16.04 LTS | apr | 1.5.2-3ubuntu0.1~esm2 | USN-7038-1 |
| Ubuntu Pro 14.04 LTS | apr | 1.5.0-1ubuntu0.1~esm2 | USN-7038-2 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | apr | 1.6.3-150000.3.6.1 | SUSE-SU-2024:3428-1 |
| SLES 15 SP5 | apr | 1.6.3-150000.3.6.1 | SUSE-SU-2024:3428-1 |
| SLES 12 SP5 | libapr1 | 1.5.1-4.8.1 | SUSE-SU-2026:4927-1, SUSE-SU-2024:3429-1 |
| SLES 12 SP5 | libtcnative-1-0 | 1.3.9-3.9.1 | SUSE-SU-2026:4927-1 |
| SLES 12 SP5 | tomcat | 9.0.123-3.182.2 | SUSE-SU-2026:4927-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libapr1 | 1.5.1-4.8.1 | SUSE-SU-2024:3429-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apr | 1.7.5-1.1 | openSUSE-SU-2024:14347-1 |
| openSUSE Leap 15.6 | apr | 1.6.3-150000.3.6.1 | SUSE-SU-2024:3428-1 |
| openSUSE Leap 15.5 | apr | 1.6.3-150000.3.6.1 | SUSE-SU-2024:3428-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apr | 1.7.5-r0 | — |
| Alpine v3.23 | apr | 1.7.5-r0 | — |
| Alpine v3.22 | apr | 1.7.5-r0 | — |
| Alpine v3.21 | apr | 1.7.5-r0 | — |
| Alpine v3.20 | apr | 1.7.5-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apr | 1.7.5-r0 | — |
| Alpine v3.18 | apr | 1.7.5-r0 | — |
| Alpine v3.17 | apr | 1.7.5-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | apr +1 | 1.7.5-1.amzn2023.0.2 | ALAS2023-2024-789 |
| Amazon Linux 2 | apr +1 | 1.7.2-1.amzn2.0.1 | ALAS2-2024-2721 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | apr | 1.7.5-1 | — |
| Azure Linux 2 (CBL-Mariner) | apr | 1.7.5-1 | — |
Advisories 17
- SUSE-SU-2026:4927-1 Security update for libapr1, libtcnative-1-0, tomcat SUSE / openSUSE Security Updates · Oct 31, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-7038-2 apr vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-7038-1 apr vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2024:3428-1 Security update for apr SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3429-1 Security update for apr SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14347-1 apr-devel-1.7.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- WID-SEC-2025-1571 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2024-1929 Apache Portable Runtime (APR): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 2, 2025
- NCSC-2025-0127 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0824 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0819 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- ALAS2-2024-2721 Moderate: apr security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2024
- ALAS2023-2024-789 Moderate: apr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Dec 16, 2024
References
- https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4 vendor-advisory