Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
CVE-2022-24963

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Portable Runtime (apr)
Vendor
CVE Published:
31 January 2023

What is CVE-2022-24963?

An integer overflow vulnerability exists in the apr_encode functions of the Apache Portable Runtime (APR), which can lead to unauthorized memory write operations. Exploiting this vulnerability allows attackers to write beyond the allocated memory bounds, potentially leading to data corruption or a complete system compromise. Users of APR version 1.7.0 should evaluate their systems and apply necessary security measures as outlined in the vendor advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Portable Runtime (APR) 1.7.0

References

https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57x...
vendor-advisory
https://security.netapp.com/advisory/ntap-20230908-0008/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ronald Crane (Zippenhop LLC)
JSON
.