CVE-2010-1623
En bref
- Source
- NVD
- EPSS
- EPSS 20.33 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
Faiblesses (CWE)
- CWE-119 — Opération hors des limites d'un tampon mémoire
Références
- http://svn.apache.org/viewvc?view=revision&revision=1003494
- http://svn.apache.org/viewvc?view=revision&revision=1003492
- http://secunia.com/advisories/43285
- http://www.vupen.com/english/advisories/2010/3065
- http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
- http://www.vupen.com/english/advisories/2010/3064
- http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html
- http://security-tracker.debian.org/tracker/CVE-2010-1623
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html
- http://www.vupen.com/english/advisories/2010/2806
- http://secunia.com/advisories/41701
- http://www.ubuntu.com/usn/USN-1022-1
- http://www.redhat.com/support/errata/RHSA-2010-0950.html
- http://secunia.com/advisories/42361
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800
- http://svn.apache.org/viewvc?view=revision&revision=1003626
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601
- http://www.redhat.com/support/errata/RHSA-2011-0897.html
- http://www.vupen.com/english/advisories/2010/2556
- http://secunia.com/advisories/42403
- http://www.securityfocus.com/bid/43673
- http://svn.apache.org/viewvc?view=revision&revision=1003495
- http://www.redhat.com/support/errata/RHSA-2011-0896.html
- http://secunia.com/advisories/42367
- http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak
- http://secunia.com/advisories/43211
- http://secunia.com/advisories/42015
- http://secunia.com/advisories/42537
- http://svn.apache.org/viewvc?view=revision&revision=1003493
- http://marc.info/?l=bugtraq&m=130168502603566&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:192
- http://www.vupen.com/english/advisories/2010/2557
- http://www.vupen.com/english/advisories/2010/3074
- http://ubuntu.com/usn/usn-1021-1
- http://www.vupen.com/english/advisories/2011/0358
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E
- +9 autres
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-1646
- GCVE · GCVE-0-2010-1623
Avis du CERT-FR
- CERTA-2012-AVI-218 — Multiples vulnérabilités dans HP System Management Homepage · cert.ssi.gouv.fr
- CERTA-2012-AVI-023 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTA-2011-AVI-524 — Multiples vulnérabilités dans Blue Coat Director · cert.ssi.gouv.fr
- CERTA-2010-AVI-550 — Vulnérabilités dans IBM HTTP Server et WebSphere · cert.ssi.gouv.fr
- CERTA-2010-AVI-510 — Vulnérabilités dans Apache · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*≤ 1.3.9cpe:2.3:a:apache:apr-util:0.9.1:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.2:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.3:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.4:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.5:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.6:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.7:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.8:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.9:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.10:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.11:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.12:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.13:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.14:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.15:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.16:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.17:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:0.9.18:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.1:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.2:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.6:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.7:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.8:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.9:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.10:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.12:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.2.13:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.1:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.2:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.3:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.4:*:*:*:*:*:*:*cpe:2.3:a:apache:apr-util:1.3.5:*:*:*:*:*:*:*- +5 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |