CVE-2023-49582: Apache Portable Runtime (APR): Unexpected lax shared memory permissions
Apache Portable Runtime (APR): Unexpected lax shared memory permissions
Other sources
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 (apr.h)
Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49582?
CVE-2023-49582 is considered to have a medium severity due to lax permission settings allowing local read access to sensitive data.
How do I fix CVE-2023-49582?
To mitigate CVE-2023-49582, update the Apache Portable Runtime library to version 1.7.5 or later.
Who is affected by CVE-2023-49582?
CVE-2023-49582 affects local users on Unix platforms running vulnerable versions of the Apache Portable Runtime.
What types of data can be exposed due to CVE-2023-49582?
CVE-2023-49582 may expose sensitive application data stored in named shared memory segments.
Is CVE-2023-49582 relevant to non-Unix platforms?
CVE-2023-49582 does not affect non-Unix platforms, only Unix-based systems are vulnerable.