CVE-2009-2412

Publication date 6 August 2009

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
apache2 9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Fixed 2.0.55-4ubuntu2.7
apr 9.04 jaunty
Fixed 1.2.12-5ubuntu0.1
8.10 intrepid
Fixed 1.2.12-4ubuntu0.1
8.04 LTS hardy
Fixed 1.2.11-1ubuntu0.1
6.06 LTS dapper Not in release
apr-util 9.04 jaunty
Fixed 1.2.12+dfsg-8ubuntu0.3
8.10 intrepid
Fixed 1.2.12+dfsg-7ubuntu0.3
8.04 LTS hardy
Fixed 1.2.12+dfsg-3ubuntu0.2
6.06 LTS dapper Not in release

Notes

jdstrand

apache2 on hardy and higher uses system apr and apr-util

References

Related Ubuntu Security Notices (USN)

    • USN-813-3
    • apr-util vulnerability
    • 8 August 2009
    • USN-813-2
    • Apache vulnerability
    • 8 August 2009

Other references