CVE-2017-12613: apache software foundation apache portable runtime Out-of-bounds Read
Vulnerability summary
CVE-2017-12613 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in apache software foundation apache portable runtime. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.8% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 24-10-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
1.75%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.75% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat15 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus6.7 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.4 | 6.5 | 6.6 | 7.2 | 7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_tus6.6 | 7.2 | 7.3 | 7.4 | 7.6 | 7.7
Suse7 products
- libapr1&distro=SUSE Linux Enterprise Server 11 SP4< 1.3.3-11.18.19.13.2
- libapr1&distro=SUSE Linux Enterprise Server 12 SP3< 1.5.1-4.3.1
- libapr1&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 1.3.3-11.18.19.13.2
- libapr1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 1.5.1-4.3.1
- libapr1&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 1.3.3-11.18.19.13.2
Debian2 products
- apr< 1.6.3-1 | < 1.4.6-3+deb7u2 | < 1.5.2-5+deb9u1
- debian_linuxEOL7.0 | 9.0
Mageia2 products
- apr< 1.5.1-3.1.mga5
- apr< 1.5.2-2.1.mga6
Apache1 product
- portable_runtime< 1.7.0
Apache software foundation1 product
- apache portable runtime1.6.2 and prior
Ubuntu1 product
- apr< 1.5.0-1ubuntu0.1~esm1 | < 1.5.2-3ubuntu0.1~esm1
7 vendors · 29 products
References
38 links
lists.debian.org/debian-lts-announce/2017/11/msg00005.htmlMailing ListX Refsource MLISTThird Party Advisory- access.redhat.com/errata/RHSA-2018:0316Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- svn.apache.org/viewvc?view=revision&revision=1807976X Refsource CONFIRMIssue TrackingThird Party Advisory
- access.redhat.com/errata/RHSA-2017:3270Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 38 references
- access.redhat.com/errata/RHSA-2018:1253Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- lists.debian.org/debian-lts-announce/2022/01/msg00023.htmlMailing ListX Refsource MLISTThird Party Advisory
