Out-of-bounds Read Affecting apr-util package, versions <1.5.3-1ubuntu0.1~esm1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UBUNTU1404-APRUTIL-340303
- published 24 Oct 2017
- disclosed 24 Oct 2017
Introduced: 24 Oct 2017
CVE-2017-12618 Open this link in a new tabHow to fix?
Upgrade Ubuntu:14.04
apr-util
to version 1.5.3-1ubuntu0.1~esm1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream apr-util
package and not the apr-util
package as distributed by Ubuntu
.
See How to fix?
for Ubuntu:14.04
relevant fixed versions and status.
Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12618
- https://lists.debian.org/debian-lts-announce/2017/11/msg00006.html
- https://security-tracker.debian.org/tracker/CVE-2017-12618
- http://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252POs4toeJJciwg09_eu2cO3XFg%3DUqsPjXsfjDoeC3-UQ%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/101558
- http://www.securitytracker.com/id/1042004