PT-2023-8451 · Apache+6 · Apache Portable Runtime+6

Ronald Crane · CVE-2022-24963 · Publicado 2023-01-31 · Atualizado 2025-01-20

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime (APR) version 1.7.0

Description The issue is related to an Integer Overflow or Wraparound vulnerability in the apr encode functions of Apache Portable Runtime (APR), allowing an attacker to write beyond the bounds of a buffer. This can potentially enable a remote attacker to execute arbitrary code.

Recommendations For Apache Portable Runtime (APR) version 1.7.0, update to a version that fixes the Integer Overflow or Wraparound vulnerability in the apr encode functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALSA-2023:7711

ALT-PU-2024-15150

AZL-13226

AZL-34546

BDU:2024-00850

BIT-APR-2022-24963

CVE-2022-24963

DSA-5370-1

INFSA-2023_7711

MGASA-2023-0063

OESA-2023-1095

OESA-2023-1096

OESA-2023-1117

OESA-2023-1118

OPENSUSE-SU-2024:12655-1

RHSA-2023:4629

RHSA-2023:4909

RHSA-2023:7711

RHSA-2023_7711

RLSA-2023:7711

USN-5885-1

Produtos afetados

Alt Linux

Almalinux

Apache Portable Runtime

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Referências · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24963.json · Exploit
• https://github.com/apache/apr/commit/622905ddfa7b45dfca350e13442892de3c1f48e9 · Nota
• https://osv.dev/vulnerability/AZL-34546 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2023-1118 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-24963 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-24963 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2023-7711.html · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2023:7711 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-apr-2022-24963 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2022-24963 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24963 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=31485 · Nota
• https://errata.almalinux.org/9/ALSA-2023-7711.html · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230908-0008 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-24963 · Nota de Segurança