CVE-2009-2412: Buffer Overflow
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocatoralloc or (2) aprpalloc function in memory/unix/aprpools.c in APR; or crafted calls to the (3) aprrmmmalloc, (4) aprrmmcalloc, or (5) aprrmmrealloc function in misc/aprrmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2412?
CVE-2009-2412 has a medium severity rating due to its potential to cause application crashes and possible arbitrary code execution.
How do I fix CVE-2009-2412?
To fix CVE-2009-2412, upgrade to a patched version of the Apache Portable Runtime (APR) library and APR-util that addresses this vulnerability.
Which versions are affected by CVE-2009-2412?
CVE-2009-2412 affects multiple versions of the Apache Portable Runtime and APR-util, including versions 0.9.x and 1.3.x.
What type of vulnerability is CVE-2009-2412?
CVE-2009-2412 is an integer overflow vulnerability that may lead to denial of service and arbitrary code execution.
Who is impacted by CVE-2009-2412?
Any application utilizing the vulnerable versions of the Apache Portable Runtime and APR-util libraries is at risk from CVE-2009-2412.