Apache Portable Runtime Utility vulnerabilities

2 CVEs affecting Apache Portable Runtime Utility, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25147, published 2023-01-31.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-25147, published 2023-01-31. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache…
• CVE-2017-12618, published 2017-10-24. Medium severity, CVSS 4.7. EPSS: 0.6% chance of exploitation in the next 30 days. Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A…