Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

CVE-2022-24963

What is CVE-2022-24963?

An integer overflow vulnerability exists in the apr_encode functions of the Apache Portable Runtime (APR), which can lead to unauthorized memory write operations. Exploiting this vulnerability allows attackers to write beyond the allocated memory bounds, potentially leading to data corruption or a complete system compromise. Users of APR version 1.7.0 should evaluate their systems and apply necessary security measures as outlined in the vendor advisories.

References