FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

apr -- multiple vulnerabilities

Affected packages
apr <
2.2.0 <= apache < 2.2.11_5
2.0.0 <= apache < 2.0.63_3


VuXML ID eb9212f7-526b-11de-bbf2-001b77d09812
Discovery 2009-06-05
Entry 2009-06-08

Secunia reports:

Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).

A vulnerability is caused due to an error in the processing of XML files and can be exploited to exhaust all available memory via a specially crafted XML file containing a predefined entity inside an entity definition.

A vulnerability is caused due to an error within the "apr_strmatch_precompile()" function in strmatch/apr_strmatch.c, which can be exploited to crash an application using the library.

RedHat reports:

A single NULL byte buffer overflow flaw was found in apr-util's apr_brigade_vprintf() function.


Bugtraq ID 35221
CVE Name CVE-2009-0023
CVE Name CVE-2009-1955
CVE Name CVE-2009-1956