Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3270. CentOS Errata and Security Advisory 2017:3270 Important Upstream details at : https://access.redhat.com/errata/RHSA-2017:3270 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f43725ed8ac01193b5ffc66369caaed7e8b1bcaeff24e0c8fcf92a36a868f227 apr-1.3.9-5.el6_9.1.i686.rpm 1a0b7a2ea85f3c4aebe8831fca8058ebc002122d8502fca42e7b39858d916faf apr-devel-1.3.9-5.el6_9.1.i686.rpm x86_64: f43725ed8ac01193b5ffc66369caaed7e8b1bcaeff24e0c8fcf92a36a868f227 apr-1.3.9-5.el6_9.1.i686.rpm 85a772c6b36978427577f740a9597d7c2bb3e90e5ad1752c3f65cfa2657a9ee7 apr-1.3.9-5.el6_9.1.x86_64.rpm 1a0b7a2ea85f3c4aebe8831fca8058ebc002122d8502fca42e7b39858d916faf apr-devel-1.3.9-5.el6_9.1.i686.rpm a86fe286455773b17644990de88e5c8cf9400d6dbcb39af0823d8e99cbb92026 apr-devel-1.3.9-5.el6_9.1.x86_64.rpm Source: 17e84de76c7f30bb574389344dda75b04aad703e40a71342ebf271d33c424551 apr-1.3.9-5.el6_9.1.src.rpm -- Johnny Hughes CentOS Project { https://www.centos.org/ } irc: hughesjr, #
Updated apr and apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: apr and apr-util security update Advisory ID: RHSA-2009:1204-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1204.html Issue date: 2009-08-10 CVE Names: CVE-2009-2412 ==================================================================== 1. Summary: Updated apr and apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It aims to provide a free library of C data structures and routines. apr-util is a utility library used with APR. This library provides additional utility interfaces for APR; including support for XML parsing, LDAP, database interfaces, URI parsing, and more. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the Apache Portable Runtime (APR) manages memory pool and relocatable memory allocations. An attacker could use these flaws to issue a specially-craftedrequest for memory allocation, which would lead to a denial of service (application crash) or, potentially, execute arbitrary code with the privileges of an application using the APR libraries. (CVE-2009-2412) All apr and apr-util users should upgrade to these updated packages, which contain backported patches to correct these issues. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 515698 - CVE-2009-2412 apr, apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management 6. Package List: Red Hat Enterprise Linux AS version4: Source: i386: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-devel-0.9.4-24.9.el4_8.2.i386.rpm apr-util-0.9.4-22.el4_8.2.i386.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.i386.rpm apr-util-devel-0.9.4-22.el4_8.2.i386.rpm ia64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.ia64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.ia64.rpm apr-devel-0.9.4-24.9.el4_8.2.ia64.rpm apr-util-0.9.4-22.el4_8.2.ia64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.ia64.rpm apr-util-devel-0.9.4-22.el4_8.2.ia64.rpm ppc: apr-0.9.4-24.9.el4_8.2.ppc.rpm apr-0.9.4-24.9.el4_8.2.ppc64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.ppc.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.ppc64.rpm apr-devel-0.9.4-24.9.el4_8.2.ppc.rpm apr-util-0.9.4-22.el4_8.2.ppc.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.ppc.rpm apr-util-devel-0.9.4-22.el4_8.2.ppc.rpm s390: apr-0.9.4-24.9.el4_8.2.s390.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.s390.rpm apr-devel-0.9.4-24.9.el4_8.2.s390.rpm apr-util-0.9.4-22.el4_8.2.s390.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.s390.rpm apr-util-devel-0.9.4-22.el4_8.2.s390.rpm s390x: apr-0.9.4-24.9.el4_8.2.s390.rpm apr-0.9.4-24.9.el4_8.2.s390x.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.s390.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.s390x.rpm apr-devel-0.9.4-24.9.el4_8.2.s390x.rpm apr-util-0.9.4-22.el4_8.2.s390x.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.s390x.rpm apr-util-devel-0.9.4-22.el4_8.2.s390x.rpm x86_64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.x86_64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.x86_64.rpm apr-devel-0.9.4-24.9.el4_8.2.x86_64.rpm apr-util-0.9.4-22.el4_8.2.x86_64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.x86_64.rpm apr-util-devel-0.9.4-22.el4_8.2.x86_64.rpm Red Hat Enterprise Linux Desktop version4: Source: i386: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-devel-0.9.4-24.9.el4_8.2.i386.rpm apr-util-0.9.4-22.el4_8.2.i386.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.i386.rpm apr-util-devel-0.9.4-22.el4_8.2.i386.rpm x86_64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.x86_64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.x86_64.rpm apr-devel-0.9.4-24.9.el4_8.2.x86_64.rpm apr-util-0.9.4-22.el4_8.2.x86_64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.x86_64.rpm apr-util-devel-0.9.4-22.el4_8.2.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-devel-0.9.4-24.9.el4_8.2.i386.rpm apr-util-0.9.4-22.el4_8.2.i386.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.i386.rpm apr-util-devel-0.9.4-22.el4_8.2.i386.rpm ia64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.ia64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.ia64.rpm apr-devel-0.9.4-24.9.el4_8.2.ia64.rpm apr-util-0.9.4-22.el4_8.2.ia64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.ia64.rpm apr-util-devel-0.9.4-22.el4_8.2.ia64.rpm x86_64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.x86_64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.x86_64.rpm apr-devel-0.9.4-24.9.el4_8.2.x86_64.rpm apr-util-0.9.4-22.el4_8.2.x86_64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.x86_64.rpm apr-util-devel-0.9.4-22.el4_8.2.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-devel-0.9.4-24.9.el4_8.2.i386.rpm apr-util-0.9.4-22.el4_8.2.i386.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.i386.rpm apr-util-devel-0.9.4-22.el4_8.2.i386.rpm ia64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.ia64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.ia64.rpm apr-devel-0.9.4-24.9.el4_8.2.ia64.rpm apr-util-0.9.4-22.el4_8.2.ia64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.ia64.rpm apr-util-devel-0.9.4-22.el4_8.2.ia64.rpm x86_64: apr-0.9.4-24.9.el4_8.2.i386.rpm apr-0.9.4-24.9.el4_8.2.x86_64.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.i386.rpm apr-debuginfo-0.9.4-24.9.el4_8.2.x86_64.rpm apr-devel-0.9.4-24.9.el4_8.2.x86_64.rpm apr-util-0.9.4-22.el4_8.2.x86_64.rpm apr-util-debuginfo-0.9.4-22.el4_8.2.x86_64.rpm apr-util-devel-0.9.4-22.el4_8.2.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: apr-1.2.7-11.el5_3.1.i386.rpm apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-docs-1.2.7-11.el5_3.1.i386.rpm apr-util-1.2.7-7.el5_3.2.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-docs-1.2.7-7.el5_3.2.i386.rpm x86_64: apr-1.2.7-11.el5_3.1.i386.rpm apr-1.2.7-11.el5_3.1.x86_64.rpm apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-debuginfo-1.2.7-11.el5_3.1.x86_64.rpm apr-docs-1.2.7-11.el5_3.1.x86_64.rpm apr-util-1.2.7-7.el5_3.2.i386.rpm apr-util-1.2.7-7.el5_3.2.x86_64.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.x86_64.rpm apr-util-docs-1.2.7-7.el5_3.2.x86_64.rpm RHEL Desktop Workstation (v. 5client): Source: i386: apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-devel-1.2.7-11.el5_3.1.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-devel-1.2.7-7.el5_3.2.i386.rpm x86_64: apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-debuginfo-1.2.7-11.el5_3.1.x86_64.rpm apr-devel-1.2.7-11.el5_3.1.i386.rpm apr-devel-1.2.7-11.el5_3.1.x86_64.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.x86_64.rpm apr-util-devel-1.2.7-7.el5_3.2.i386.rpm apr-util-devel-1.2.7-7.el5_3.2.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: apr-1.2.7-11.el5_3.1.i386.rpm apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-devel-1.2.7-11.el5_3.1.i386.rpm apr-docs-1.2.7-11.el5_3.1.i386.rpm apr-util-1.2.7-7.el5_3.2.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-devel-1.2.7-7.el5_3.2.i386.rpm apr-util-docs-1.2.7-7.el5_3.2.i386.rpm ia64: apr-1.2.7-11.el5_3.1.ia64.rpm apr-debuginfo-1.2.7-11.el5_3.1.ia64.rpm apr-devel-1.2.7-11.el5_3.1.ia64.rpm apr-docs-1.2.7-11.el5_3.1.ia64.rpm apr-util-1.2.7-7.el5_3.2.ia64.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.ia64.rpm apr-util-devel-1.2.7-7.el5_3.2.ia64.rpm apr-util-docs-1.2.7-7.el5_3.2.ia64.rpm ppc: apr-1.2.7-11.el5_3.1.ppc.rpm apr-1.2.7-11.el5_3.1.ppc64.rpm apr-debuginfo-1.2.7-11.el5_3.1.ppc.rpm apr-debuginfo-1.2.7-11.el5_3.1.ppc64.rpm apr-devel-1.2.7-11.el5_3.1.ppc.rpm apr-devel-1.2.7-11.el5_3.1.ppc64.rpm apr-docs-1.2.7-11.el5_3.1.ppc.rpm apr-util-1.2.7-7.el5_3.2.ppc.rpm apr-util-1.2.7-7.el5_3.2.ppc64.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.ppc.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.ppc64.rpm apr-util-devel-1.2.7-7.el5_3.2.ppc.rpm apr-util-devel-1.2.7-7.el5_3.2.ppc64.rpm apr-util-docs-1.2.7-7.el5_3.2.ppc.rpm s390x: apr-1.2.7-11.el5_3.1.s390.rpm apr-1.2.7-11.el5_3.1.s390x.rpm apr-debuginfo-1.2.7-11.el5_3.1.s390.rpm apr-debuginfo-1.2.7-11.el5_3.1.s390x.rpm apr-devel-1.2.7-11.el5_3.1.s390.rpm apr-devel-1.2.7-11.el5_3.1.s390x.rpm apr-docs-1.2.7-11.el5_3.1.s390x.rpm apr-util-1.2.7-7.el5_3.2.s390.rpm apr-util-1.2.7-7.el5_3.2.s390x.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.s390.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.s390x.rpm apr-util-devel-1.2.7-7.el5_3.2.s390.rpm apr-util-devel-1.2.7-7.el5_3.2.s390x.rpm apr-util-docs-1.2.7-7.el5_3.2.s390x.rpm x86_64: apr-1.2.7-11.el5_3.1.i386.rpm apr-1.2.7-11.el5_3.1.x86_64.rpm apr-debuginfo-1.2.7-11.el5_3.1.i386.rpm apr-debuginfo-1.2.7-11.el5_3.1.x86_64.rpm apr-devel-1.2.7-11.el5_3.1.i386.rpm apr-devel-1.2.7-11.el5_3.1.x86_64.rpm apr-docs-1.2.7-11.el5_3.1.x86_64.rpm apr-util-1.2.7-7.el5_3.2.i386.rpm apr-util-1.2.7-7.el5_3.2.x86_64.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.i386.rpm apr-util-debuginfo-1.2.7-7.el5_3.2.x86_64.rpm apr-util-devel-1.2.7-7.el5_3.2.i386.rpm apr-util-devel-1.2.7-7.el5_3.2.x86_64.rpm apr-util-docs-1.2.7-7.el5_3.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2009-2412 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2009 Red Hat, Inc. . A critical security enhancement for Red Hat's apr and apr-util addresses integer overflow vulnerabilities that could lead to denial-of-service attacks.. Red Hat Security, APR Update, Memory Management. . LinuxSecurity.com Team
Matt Lewis discovered that the memory management code in the Apache Portable Runtime (APR) library does not guard against a wrap-around during size computations. This could cause the library to return a memory area which smaller than requested, resulting a heap overflow . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1854-1
New apr packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] apr (SSA:2009-219-02) New apr packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2009-2412 Here are the details from the Slackware 12.2 ChangeLog: +--------------------------+ patches/packages/apr-1.3.8-i486-1_slack12.2.tgz: Upgraded. Fix overflow in pools and rmm, where size alignment was taking place. [Matt Lewis , Sander Striker] For more information, see: https://www.cve.org/CVERecord?id=CVE-2009-2412 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 11.0: apr-util-1.3.9-i486-1_slack11.0.tgz Updated package for Slackware 12.0: apr-util-1.3.9-i486-1_slack12.0.tgz Updated package for Slackware 12.1: apr-util-1.3.9-i486-1_slack12.1.tgz Updated package for Slackware 12.2: apr-util-1.3.9-i486-1_slack12.2.tgz Updated package for Slackware -current: l/apr-util-1.3.9-i486-1.txz Updated package for Slackware64 -current: l/apr-util-1.3.9-x86_64-1.txz MD5 signatures: +-------------+ Slackware 11.0 package: dfb02bf26c81e640916ab1ad9b3a67ae apr-1.3.8-i486-1_slack11.0.tgz Slackware 12.0 package: 30a9120cc1e77e07e48f1f4b2fa75f40 apr-1.3.8-i486-1_slack12.0.tgz Slackware 12.1 package: c1e7dcb613541281b1fd491442d5e94f apr-1.3.8-i486-1_slack12.1.tgz Slackware 12.2 package: cfb3a4a245b83a25f51e5552e39b2aa4 apr-1.3.8-i486-1_slack12.2.tgz Slackware -current package: 4807d86a16ffff5f1d4974f1d5151cc1 apr-1.3.8-i486-1.txz Slackware64 -current package: 223252fbe0ffb7aa836eab131a1bef84 apr-1.3.8-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg apr-1.3.8-i486-1_slack12.2.tgz +-----+ . Recent apr updates for Slackware address major security vulnerabilities. Ensure your system's integrity with these essential patches.. Slackware Security, Apr Package Update, Security Fix, Critical Threat. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.