Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 6 articles for you...
91
security advisorydenial of serviceGentooGentoo: GLSA-202305-20 Low Severity: libapreq2 Buffer Overflow DoS
A buffer overflow vulnerability has been discovered in libapreq2 which could result in denial of service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202305-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: libapreq2: Buffer Overflow Date: May 03, 2023 Bugs: #866536 ID: 202305-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A buffer overflow vulnerability has been discovered in libapreq2 which could result in denial of service. Background ========= libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apache/libapreq2 < 2.17 > = 2.17 Description ========== TODO Impact ===== An attacker could submit a crafted multipart form to trigger the buffer overflow and cause a denial of service. Workaround ========= There is no known workaround at this time. Resolution ========= All libapreq2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apache/libapreq2-2.17" References ========= [ 1 ] CVE-2022-22728 https://nvd.nist.gov/vuln/detail/CVE-2022-22728 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202305-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us.Any security concerns should be addressed to
May 03, 2023
•Low
Gentoo
203
security advisorydenial of servicebuffer overflowMageia 8: MGASA-2023-0123 Critical: libapreq2 Buffer Overflow Issue
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. (CVE-2022-22728) . MGASA-2023-0123 - Updated libapreq2 packages fix security vulnerability Publication date: 06 Apr 2023 URL: https://advisories.mageia.org/MGASA-2023-0123.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-22728 A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. (CVE-2022-22728) References: - https://bugs.mageia.org/show_bug.cgi?id=30778 - https://www.openwall.com/lists/oss-security/2022/08/25/3 - https://lists.fedoraproject.org/archives/list/
Apr 06, 2023
•Critical
Mageia
197
security advisorydenial of servicebuffer overflowDebian Buster: DLA-3269-1 Critical: Libapreq2 Buffer Overflow
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3269-1
Jan 14, 2023
•Critical
Debian LTS
89
security advisoryFedoramemory corruptionFedora 35: 2022-cf658a432f Critical: libapreq2 Memory Corruption Fix
Fix CVE-2022-22728.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-cf658a432f 2022-09-13 01:29:12.232105 --------------------------------------------------------------------------------Name : libapreq2 Product : Fedora 35 Version : 2.17 Release : 1.fc35 URL : https://httpd.apache.org/apreq/ Summary : Apache HTTP request library Description : libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Functionality includes parsing of application/x-www-form-urlencoded and multipart/form-data content, as well as HTTP cookies. --------------------------------------------------------------------------------Update Information: Fix CVE-2022-22728. --------------------------------------------------------------------------------ChangeLog: * Sat Sep 3 2022 Bojan Smojver - 2.17-1 - Bump up to 2.17 - CVE-2022-22728 * Thu Jul 21 2022 Fedora Release Engineering - 2.16-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Wed Jun 1 2022 Jitka Plesnikova - 2.16-5 - Perl 5.36 rebuild * Thu Jan 20 2022 Fedora Release Engineering - 2.16-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2123769 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123769 [ 2 ] Bug #2123770 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123770 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-cf658a432f' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 12, 2022
•Critical
Fedora
89
security advisoryfedoramemory corruptionFedora 36: 2022-61f5b492b7 Moderate: libapreq2 Memory Corruption Fix
Fix CVE-2022-22728.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-61f5b492b7 2022-09-13 01:25:49.112172 --------------------------------------------------------------------------------Name : libapreq2 Product : Fedora 36 Version : 2.17 Release : 1.fc36 URL : https://httpd.apache.org/apreq/ Summary : Apache HTTP request library Description : libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Functionality includes parsing of application/x-www-form-urlencoded and multipart/form-data content, as well as HTTP cookies. --------------------------------------------------------------------------------Update Information: Fix CVE-2022-22728. --------------------------------------------------------------------------------ChangeLog: * Sat Sep 3 2022 Bojan Smojver - 2.17-1 - Bump up to 2.17 - CVE-2022-22728 * Thu Jul 21 2022 Fedora Release Engineering - 2.16-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Wed Jun 1 2022 Jitka Plesnikova - 2.16-5 - Perl 5.36 rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2123769 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123769 [ 2 ] Bug #2123770 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123770 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-61f5b492b7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keysused by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 12, 2022
Fedora
89
security advisoryFedorasoftware patchFedora 37: libapreq2 Memory Corruption Fix (CVE-2022-22728)
Fix CVE-2022-22728.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-9e5046934e 2022-09-12 17:36:48.820675 --------------------------------------------------------------------------------Name : libapreq2 Product : Fedora 37 Version : 2.17 Release : 1.fc37 URL : https://httpd.apache.org/apreq/ Summary : Apache HTTP request library Description : libapreq is a shared library with associated modules for manipulating client request data via the Apache API. Functionality includes parsing of application/x-www-form-urlencoded and multipart/form-data content, as well as HTTP cookies. --------------------------------------------------------------------------------Update Information: Fix CVE-2022-22728. --------------------------------------------------------------------------------ChangeLog: * Sat Sep 3 2022 Bojan Smojver - 2.17-1 - Bump up to 2.17 - CVE-2022-22728 --------------------------------------------------------------------------------References: [ 1 ] Bug #2123769 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123769 [ 2 ] Bug #2123770 - CVE-2022-22728 libapreq2: multipart form parse memory corruption [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2123770 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-9e5046934e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 12, 2022
•Important
Fedora
172
security advisorysoftware patchupdate instructionsUbuntu 18.04 LTS USN-4558-1: Libapreq2 Crash Risk from Network Traffic
libapreq2 could be made to crash if it received specially crafted network traffic.. =========================================================================Ubuntu Security Notice USN-4558-1 September 30, 2020 libapreq2 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: libapreq2 could be made to crash if it received specially crafted network traffic. Software Description: - libapreq2: a safe, standards-compliant, high-performance library used for parsing HTTP cookies, query-strings and POST data Details: It was discovered that libapreq2 did not properly sanitize the Content-Type field in certain, crafted HTTP requests. An attacker could use this vulnerability to cause libapreq2 to crash. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: libapache2-mod-apreq2 2.13-7~deb10u1build0.18.04.1 libapache2-request-perl 2.13-7~deb10u1build0.18.04.1 libapreq2-3 2.13-7~deb10u1build0.18.04.1 libapreq2-dev 2.13-7~deb10u1build0.18.04.1 In general, a standard system update will make all the necessary changes. References: CVE-2019-12412 Package Information: https://launchpad.net/ubuntu/+source/libapreq2/2.13-7~deb10u1build0.18.04.1 -- ubuntu-security-announce mailing list
Sep 30, 2020
•Critical
Ubuntu
203
security advisorydenial of serviceremote attackMageia: 2019-0327 Moderate: libapreq2 NULL Pointer Dereference Attack
Updated libapreq2 packages fix security vulnerability: Max Kellermann reported a NULL pointer dereference flaw in libapreq2, allowing a remote attacker to cause a denial of service against an application using the library (application crash) if an invalid nested . MGASA-2019-0327 - Updated libapreq2 packages fix security vulnerability Publication date: 14 Nov 2019 URL: https://advisories.mageia.org/MGASA-2019-0327.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-12412 Updated libapreq2 packages fix security vulnerability: Max Kellermann reported a NULL pointer dereference flaw in libapreq2, allowing a remote attacker to cause a denial of service against an application using the library (application crash) if an invalid nested "multipart" body is processed (CVE-2019-12412). References: - https://bugs.mageia.org/show_bug.cgi?id=25638 - https://lists.debian.org/debian-security-announce/2019/msg00190.html - https://www.cve.org/CVERecord?id=CVE-2019-12412 SRPMS: - 7/core/libapreq2-2.130.0-28.1.mga7 . Enhanced libapreq2 versions resolve a severe NULL pointer vulnerability highlighted by Max Kellermann, boosting system resilience.. Mageia, libapreq2, security update, denial of service, NULL pointer flaw. . Severity: Important. LinuxSecurity.com Team
Nov 14, 2019
•Important
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!