CVE-2010-1623

Publication date 4 October 2010

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
apache2 10.10 maverick
Fixed 2.2.16-1ubuntu3.1
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
9.04 jaunty
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Fixed 2.0.55-4ubuntu2.12
apr-util 10.10 maverick
Fixed 1.3.9+dfsg-3ubuntu0.10.10.1
10.04 LTS lucid
Fixed 1.3.9+dfsg-3ubuntu0.10.04.1
9.10 karmic
Fixed 1.3.9+dfsg-1ubuntu1.1
9.04 jaunty Ignored end of life
8.04 LTS hardy
Fixed 1.2.12+dfsg-3ubuntu0.3
6.06 LTS dapper Not in release

Notes

mdeslaur

will be fixed in apache2 2.2.17. apache2 has an embedded code copy of apr-util. Dapper uses the embedded version, hardy+ uses the system apr-util. apache2 2.2.15+ also use the code in mod_reqtimeout lucid mod_reqtimeout backport already contains this fix

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
apache2
apr-util

References

Related Ubuntu Security Notices (USN)

    • USN-1021-1
    • Apache vulnerabilities
    • 25 November 2010
    • USN-1022-1
    • APR-util vulnerability
    • 25 November 2010

Other references