CVE-2010-1623: apache apr-util
Vulnerability summary
CVE-2010-1623 is a medium (CVSS 5.0) vulnerability in apache apr-util. EPSS estimates a 20.33% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 04-10-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
20.33%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 20.33% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat9 products
- apr-util< 0:0.9.4-22.el4_8.3 | < 0:1.2.7-11.el5_5.2 | < 0:1.3.9-3.el6_0.1
- apr-util-debuginfo< 0:0.9.4-22.el4_8.3 | < 0:1.2.7-11.el5_5.2 | < 0:1.3.9-3.el6_0.1
- apr-util-devel< 0:0.9.4-22.el4_8.3 | < 0:1.2.7-11.el5_5.2 | < 0:1.3.9-3.el6_0.1
- apr-util-docs< 0:1.2.7-11.el5_5.2
- apr-util-ldap< 0:1.3.9-3.el6_0.1
Apache2 products
- apr-util≤ 1.3.9 | 0.9.1 | 0.9.2 | 0.9.3 | 0.9.4 | 0.9.5 | 0.9.6 | 0.9.7 | 0.9.8 | 0.9.9 | 0.9.10 | 0.9.11 | 0.9.12 | 0.9.13 | 0.9.14 | 0.9.15 | 0.9.16 | 0.9.17 | 0.9.18 | 1.0 | 1.0.1 | 1.0.2 | 1.1.0 | 1.1.1 | 1.1.2 | 1.2.1 | 1.2.2 | 1.2.6 | 1.2.7 | 1.2.8 | 1.2.9 | 1.2.10 | 1.2.12 | 1.2.13 | 1.3.0 | 1.3.1 | 1.3.2 | 1.3.3 | 1.3.4 | 1.3.5 | 1.3.6 | 1.3.7 | 1.3.8
- http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.17
Debian2 products
- apache2< 2.2.16-3
- apr-util< 1.2.12+dfsg-8+lenny5 | < 1.3.9+dfsg-4
3 vendors · 13 products
References
67 links- slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
Show all 67 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800VDB EntrySignatureX Refsource OVALMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=swg1PM31601Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
- blogs.sun.com/security/entry/cve_2010_1623_memory_leakX Refsource CONFIRMMailing ListThird Party Advisory
- marc.info?l=bugtraq&m=130168502603566&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2010:192Vendor AdvisoryX Refsource MANDRIVAURL Repurposed
