CVE-2009-1956: apache apr-util Numeric Errors
Vulnerability summary
CVE-2009-1956 is a medium (CVSS 6.4) Numeric Errors vulnerability in apache apr-util. EPSS estimates a 12.04% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 6.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 06-06-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
12.04%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 12.04% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apache2 products
- apr-util≤ 1.3.4
- http_server≥ 2.2.0, < 2.2.12
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04
Debian1 product
- apr-util< 1.3.7+dfsg-1
3 vendors · 4 products
References
52 links- www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PK88341Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2009:131Vendor AdvisoryX Refsource MANDRIVABroken Link
- www-01.ibm.com/support/docview.wss?uid=swg1PK99478Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PK91241Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
Show all 52 references
- www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.redhat.com/support/errata/RHSA-2009-1108.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRMThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11567VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=504390X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
- lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.redhat.com/support/errata/RHSA-2009-1107.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12237VDB EntrySignatureX Refsource OVALThird Party Advisory
