CVE-2009-1956

Apache APR-util <1.3.5 - Info Disclosure

Title source: llm
STIX 2.1

Description

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

References (51)

Core 51
Core References
Mailing List mailing-list x_refsource_mlist
http://www.mail-archive.com/dev%40apr.apache.org/msg21592.html
Mailing List mailing-list x_refsource_mlist
http://www.mail-archive.com/dev%40apr.apache.org/msg21591.html
Third Party Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.html
Third Party Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.html
Third Party Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.html
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35710
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35487
Vendor Advisory x_refsource_confirm
http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1907
Third Party Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PK88341
Broken Link vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:131
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35395
Third Party Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PK99478
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35284
Third Party Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1PK91241
Exploit, Mailing List, Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/06/06/1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35251
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35843
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1108.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=129190899612998&w=2
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35797
Patch, Third Party Advisory x_refsource_confirm
http://svn.apache.org/viewvc?view=rev&revision=768417
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200907-03.xml
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-786-1
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=504390
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34724
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37221
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35565
Permissions Required vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3184
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
Mailing List, Third Party Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
Broken Link vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1107.html
Third Party Advisory x_refsource_confirm
http://support.apple.com/kb/HT3937
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-787-1

Scores

EPSS 0.1204
EPSS Percentile 95.7%

Details

CWE
CWE-189
Status published
Products (6)
apache/apr-util < 1.3.4
apache/http_server 2.2.0 - 2.2.12
canonical/ubuntu_linux 6.06
canonical/ubuntu_linux 8.04
canonical/ubuntu_linux 8.10
canonical/ubuntu_linux 9.04
Published Jun 08, 2009
Tracked Since Feb 18, 2026