Apache Portable Runtime vulnerabilities

9 CVEs affecting Apache Portable Runtime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-49582, published 2024-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0840, published 2012-02-10. Medium severity, CVSS 5.0. EPSS: 42.1% chance of exploitation in the next 30 days. tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows…
CVE-2011-0419, published 2011-05-16. Medium severity, CVSS 4.3. EPSS: 30.4% chance of exploitation in the next 30 days. Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in…
CVE-2009-2699, published 2009-10-13. High severity, CVSS 7.5. EPSS: 14.2% chance of exploitation in the next 30 days. The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other…
CVE-2009-2412, published 2009-08-06. High severity, CVSS 10.0. EPSS: 13.8% chance of exploitation in the next 30 days. Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service…
CVE-2017-12613, published 2017-10-24. High severity, CVSS 7.1. EPSS: 1.7% chance of exploitation in the next 30 days. When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting…
CVE-2022-28331, published 2023-01-31. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
CVE-2022-24963, published 2023-01-31. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime…
CVE-2021-35940, published 2021-08-23. High severity, CVSS 7.1. EPSS: 1.2% chance of exploitation in the next 30 days. An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x…
CVE-2023-49582, published 2024-08-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.…