CVE-2009-2412: apache apr-util Numeric Errors
Vulnerability summary
CVE-2009-2412 is a high (CVSS 10.0) Numeric Errors vulnerability in apache apr-util. EPSS estimates a 13.78% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 3 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 06-08-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.78%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 13.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (svn.apache.org)
Maturity: unknown
Exploit Reference (svn.apache.org)
Maturity: unknown
Exploit Reference (svn.apache.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat16 products
- apr< 0:0.9.4-24.9.el4_8.2 | < 0:1.2.7-11.el5_3.1
- apr-debuginfo< 0:0.9.4-24.9.el4_8.2 | < 0:1.2.7-11.el5_3.1
- apr-devel< 0:0.9.4-24.9.el4_8.2 | < 0:1.2.7-11.el5_3.1
- apr-docs< 0:1.2.7-11.el5_3.1
- apr-util< 0:0.9.4-22.el4_8.2 | < 0:1.2.7-7.el5_3.2
Apache2 products
- apr-util0.9.1 | 0.9.2 | 0.9.2-dev | 0.9.3 | 0.9.3-dev | 0.9.4 | 0.9.5 | 0.9.6 | 0.9.7-dev | 0.9.8 | 0.9.9 | 0.9.16 | 1.3.0 | 1.3.1 | 1.3.2 | 1.3.3 | 1.3.4 | 1.3.4-dev | 1.3.5 | 1.3.6 | 1.3.6-dev | 1.3.7 | 1.3.8
- portable_runtime0.9.1 | 0.9.2 | 0.9.2-dev | 0.9.3 | 0.9.3-dev | 0.9.4 | 0.9.5 | 0.9.6 | 0.9.7 | 0.9.7-dev | 0.9.8 | 0.9.9 | 0.9.16-dev | 1.3.0 | 1.3.1 | 1.3.2 | 1.3.3 | 1.3.4 | 1.3.4-dev | 1.3.5 | 1.3.6 | 1.3.6-dev | 1.3.7 | 1.3.8
Debian2 products
- apr< 1.2.7-9 | < 1.2.12-5+lenny1 | < 1.3.8-1
- apr-util< 1.2.7+dfsg-2+etch3 | < 1.2.12+dfsg-8+lenny4 | < 1.3.9+dfsg-1
3 vendors · 20 products
References
61 links- svn.apache.org/viewvc/apr/apr-util/branches/0.9.x/CHANGES?revision=800736&view=markupX Refsource CONFIRMExploit
Show all 61 references
- svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/CHANGES?revision=800735&view=markupX Refsource CONFIRMExploit
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8394VDB EntrySignatureX Refsource OVAL
- svn.apache.org/viewvc/apr/apr/branches/0.9.x/memory/unix/apr_pools.c?r1=585356&r2=800733X Refsource CONFIRMExploit
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9958VDB EntrySignatureX Refsource OVAL
- www.redhat.com/archives/fedora-package-announce/2009-August/msg00320.htmlVendor AdvisoryX Refsource FEDORA
- support.apple.com/kb/HT3937X Refsource CONFIRM
- www.redhat.com/archives/fedora-package-announce/2009-August/msg00353.htmlVendor AdvisoryX Refsource FEDORA
