6.5

CVE-2022-25147: apache software foundation apache portable runtime utility (apr-util) Integer Overflow or Wraparound

CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2022-25147MGASA-2023-0045SUSE-SU-2023:0324-1
Published 31-01-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2022-25147 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in apache software foundation apache portable runtime utility (apr-util). EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
1.42%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2
RHSA-2023:3354SUSE-SU-2026:3937-1SUSE-SU-2026:3938-1

Timeline

  1. 31-01-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.42%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

0.00 pp

From 1.42% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse26 products
  • apr-util&distro=SUSE Enterprise Storage 7< 1.6.1-150200.12.3.1
  • apr-util&distro=SUSE Enterprise Storage 7.1< 1.6.1-150300.18.5.1
  • apr-util&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.6.1-150000.4.9.1
  • apr-util&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.6.1-150200.12.3.1
  • apr-util&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.6.1-150300.18.5.1
Redhat19 products
  • apr-util< 0:1.6.1-6.el8_8.1 | < 0:1.5.2-6.el7_9.1 | < 0:1.6.1-20.el9_0.1 | < 0:1.6.1-20.el9_2.1 | < 0:1.6.1-6.el8_1.1 | < 0:1.6.1-6.el8_6.1 | < 0:1.6.1-6.el8_4.1 | < 0:1.6.1-6.el8_2.1
  • apr-util-bdb< 0:1.6.1-6.el8_8.1 | < 0:1.6.1-20.el9_0.1 | < 0:1.6.1-20.el9_2.1 | < 0:1.6.1-6.el8_1.1 | < 0:1.6.1-6.el8_6.1 | < 0:1.6.1-6.el8_4.1 | < 0:1.6.1-6.el8_2.1
  • apr-util-bdb-debuginfo< 0:1.6.1-6.el8_8.1 | < 0:1.6.1-20.el9_0.1 | < 0:1.6.1-20.el9_2.1 | < 0:1.6.1-6.el8_1.1 | < 0:1.6.1-6.el8_6.1 | < 0:1.6.1-6.el8_4.1 | < 0:1.6.1-6.el8_2.1
  • apr-util-debuginfo< 0:1.6.1-6.el8_8.1 | < 0:1.5.2-6.el7_9.1 | < 0:1.6.1-20.el9_0.1 | < 0:1.6.1-20.el9_2.1 | < 0:1.6.1-6.el8_1.1 | < 0:1.6.1-6.el8_6.1 | < 0:1.6.1-6.el8_4.1 | < 0:1.6.1-6.el8_2.1
  • apr-util-debugsource< 0:1.6.1-6.el8_8.1 | < 0:1.6.1-20.el9_0.1 | < 0:1.6.1-20.el9_2.1 | < 0:1.6.1-6.el8_1.1 | < 0:1.6.1-6.el8_6.1 | < 0:1.6.1-6.el8_4.1 | < 0:1.6.1-6.el8_2.1
Alpine2 products
  • apr< 1.7.1-r0
  • apr-util< 1.6.3-r0
Opensuse2 products
  • apr-util&distro=openSUSE Leap 15.4< 1.6.1-150300.18.5.1
  • apr-util&distro=openSUSE Tumbleweed< 1.6.3-1.1
Apache1 product
Apache software foundation1 product
Debian1 product
  • apr-util< 1.6.1-5+deb11u1 | < 1.6.1-4+deb10u1 | < 1.6.3-1
Mageia1 product
  • apr-util< 1.6.3-1.mga8
Ubuntu1 product
  • apr-util< 1.5.3-1ubuntu0.1~esm2 | < 1.5.4-1ubuntu0.1~esm2 | < 1.6.1-2ubuntu0.1 | < 1.6.1-4ubuntu2.1 | < 1.6.1-5ubuntu4.22.04.1

9 vendors · 54 products

References

39 links
Show all 39 references