Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability

Bugtraq ID:	35221
Class:	Design Error
CVE:	CVE-2009-0023
Remote:	Yes
Local:	No
Published:	Jun 04 2009 12:00AM
Updated:	May 07 2015 05:01PM
Credit:	Matthew Palmer
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SuSE openSUSE 10.3 Sun Solaris 10_x86 Sun Solaris 10_sparc Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 RedHat JBoss Enterprise Web Server EL4 0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4.8.z RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Certificate Server 7.3 Red Hat Enterprise Linux EUS 5.3.z server Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.8.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server Pardus Linux 2008 0 Oracle Oracle HTTP Server 9.2 .8 Oracle Oracle HTTP Server 9.2 .0 + Apache Software Foundation Apache 1.3.22 Oracle Oracle HTTP Server 9.1 + Apache Software Foundation Apache 1.3.12 Oracle Oracle HTTP Server 9.0.3 .1 Oracle Oracle HTTP Server 9.0.2 .3 + Oracle Oracle9i Application Server 9.0.2 .3 Oracle Oracle HTTP Server 9.0.2 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 Oracle Oracle HTTP Server 1.0.2 .2 Roll up 2 Oracle Oracle HTTP Server 1.0.2 .2 Oracle Oracle HTTP Server 1.0.2 .1 Oracle Oracle HTTP Server 1.0.2 .0 Oracle Oracle HTTP Server 11.1.1.5 Oracle Oracle HTTP Server 11.1.1.4 Oracle Oracle HTTP Server 11.1.1.3 Oracle Oracle HTTP Server 10.1.3.5 Oracle Oracle HTTP Server 10.1.2.3 Oracle HTTP Server for Server 9.2 Oracle HTTP Server for Server 9.0.1 Oracle HTTP Server for Server 8.1.7 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM HTTP Server 6.1 .25 IBM HTTP Server 6.1 .19 IBM HTTP Server 6.1 .17 IBM HTTP Server 6.1 .15 IBM HTTP Server 6.0.2 .35 IBM HTTP Server 6.0.2 .33 IBM HTTP Server 6.0.2 .27 IBM HTTP Server 6.0.2 .13 IBM HTTP Server 6.0.2 IBM HTTP Server 2.0.47 .1 IBM HTTP Server 2.0.47 IBM HTTP Server 7.0.0.5 IBM HTTP Server 7.0 IBM HTTP Server 6.1.0.13 IBM HTTP Server 6.1.0.1 IBM HTTP Server 6.1.0 IBM HTTP Server 6.0.2.23 IBM HTTP Server 6.0.2.19 IBM HTTP Server 6.0.2.12 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.6 Apple Mac OS X 10.5 Apache Software Foundation APR-util 1.3.4
Not Vulnerable:	IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 6.1.0.27 Apple Mac OS X Server 10.6.2 Apple Mac OS X 10.6.2 Apache Software Foundation APR-util 1.3.5

Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability

Apache 'APR-util' is prone to an integer-underflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of an affected application. Successful exploits will compromise the affected application and possibly the computer. Failed attacks will cause denial-of-service conditions.

Versions prior to 'APR-util' 1.3.5 are vulnerable.

Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.9-7u buntu3.1_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.9- 7ubuntu3.1_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.9-7 ubuntu3.1_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.9- 7ubuntu3.1_powerpc.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec-custom_2.2. 9-7ubuntu3.1_powerpc.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec_2.2.9-7ubun tu3.1_powerpc.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.9 -7ubuntu3.1_powerpc.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.9-7ubunt u3.1_powerpc.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.9-7ub untu3.1_powerpc.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-7ubuntu0.1_powerpc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-7ubuntu0.1_powerpc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-7 ubuntu0.1_powerpc.deb

Slackware Linux 12.2

• Slackware httpd-2.2.12-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ httpd-2.2.12-i486-1_slack12.2.tgz

Debian Linux 5.0 alpha

• Debian libaprutil1-dbg_1.2.12+dfsg-8+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.12+dfsg-8+lenny2_alpha.deb


• Debian libaprutil1-dev_1.2.12+dfsg-8+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.12+dfsg-8+lenny2_alpha.deb


• Debian libaprutil1_1.2.12+dfsg-8+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.12+dfsg-8+lenny2_alpha.deb

Mandriva Linux Mandrake 2008.0

• Mandriva apr-util-dbd-mysql-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apr-util-dbd-pgsql-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apr-util-dbd-sqlite3-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-devel-1.2.11-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-util-devel-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-util1-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr1-1.2.11-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.11-2 ubuntu2.1_sparc.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.11 -2ubuntu2.1_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.11- 2ubuntu2.1_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.11 -2ubuntu2.1_sparc.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_ 2.2.11-2ubuntu2.1_sparc.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.11- 2ubuntu2.1_sparc.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.1 1-2ubuntu2.1_sparc.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.11-2ubun tu2.1_sparc.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.11-2u buntu2.1_sparc.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-8ubuntu0.1_sparc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-8ubuntu0.1_sparc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-8 ubuntu0.1_sparc.deb

Debian Linux 4.0 amd64

• Debian libaprutil1-dbg_1.2.7+dfsg-2+etch2_amd64.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.7+dfsg-2+etch2_amd64.deb


• Debian libaprutil1-dev_1.2.7+dfsg-2+etch2_amd64.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.7+dfsg-2+etch2_amd64.deb


• Debian libaprutil1_1.2.7+dfsg-2+etch2_amd64.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.7+dfsg-2+etch2_amd64.deb

Debian Linux 4.0 ia-32

• Debian libaprutil1-dbg_1.2.7+dfsg-2+etch2_i386.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.7+dfsg-2+etch2_i386.deb


• Debian libaprutil1-dev_1.2.7+dfsg-2+etch2_i386.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.7+dfsg-2+etch2_i386.deb


• Debian libaprutil1_1.2.7+dfsg-2+etch2_i386.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.7+dfsg-2+etch2_i386.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.9-7u buntu3.1_sparc.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.9- 7ubuntu3.1_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.9-7 ubuntu3.1_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.9- 7ubuntu3.1_sparc.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec-custom_2.2. 9-7ubuntu3.1_sparc.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec_2.2.9-7ubun tu3.1_sparc.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.9 -7ubuntu3.1_sparc.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.9-7ubunt u3.1_sparc.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.9-7ub untu3.1_sparc.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-7ubuntu0.1_sparc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-7ubuntu0.1_sparc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-7 ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.11-2 ubuntu2.1_lpia.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.11 -2ubuntu2.1_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.11- 2ubuntu2.1_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.11 -2ubuntu2.1_lpia.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_ 2.2.11-2ubuntu2.1_lpia.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.11- 2ubuntu2.1_lpia.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.1 1-2ubuntu2.1_lpia.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.11-2ubun tu2.1_lpia.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.11-2u buntu2.1_lpia.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-8ubuntu0.1_lpia.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-8ubuntu0.1_lpia.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-8 ubuntu0.1_lpia.deb

Debian Linux 5.0 armel

• Debian libaprutil1-dbg_1.2.12+dfsg-8+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.12+dfsg-8+lenny2_armel.deb


• Debian libaprutil1-dev_1.2.12+dfsg-8+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.12+dfsg-8+lenny2_armel.deb


• Debian libaprutil1_1.2.12+dfsg-8+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.12+dfsg-8+lenny2_armel.deb

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.2.dmg
  For Mac OS X v10.6
  http://www.apple.com/support/downloads/

Debian Linux 5.0 mips

• Debian libaprutil1-dbg_1.2.12+dfsg-8+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.12+dfsg-8+lenny2_mips.deb


• Debian libaprutil1-dev_1.2.12+dfsg-8+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.12+dfsg-8+lenny2_mips.deb


• Debian libaprutil1_1.2.12+dfsg-8+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.12+dfsg-8+lenny2_mips.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suex ec-custom_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suex ec_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dbg _1.2.12+dfsg-8ubuntu0.1_amd64.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dev _1.2.12+dfsg-8ubuntu0.1_amd64.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1_1.2 .12+dfsg-8ubuntu0.1_amd64.deb

Debian Linux 4.0 mips

• Debian libaprutil1-dbg_1.2.7+dfsg-2+etch2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.7+dfsg-2+etch2_mips.deb


• Debian libaprutil1-dev_1.2.7+dfsg-2+etch2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.7+dfsg-2+etch2_mips.deb


• Debian libaprutil1_1.2.7+dfsg-2+etch2_mips.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.7+dfsg-2+etch2_mips.deb

Debian Linux 5.0 sparc

• Debian libaprutil1-dbg_1.2.12+dfsg-8+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.12+dfsg-8+lenny2_sparc.deb


• Debian libaprutil1-dev_1.2.12+dfsg-8+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.12+dfsg-8+lenny2_sparc.deb


• Debian libaprutil1_1.2.12+dfsg-8+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.12+dfsg-8+lenny2_sparc.deb

Debian Linux 4.0 arm

• Debian libaprutil1-dbg_1.2.7+dfsg-2+etch2_arm.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.7+dfsg-2+etch2_arm.deb


• Debian libaprutil1-dev_1.2.7+dfsg-2+etch2_arm.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.7+dfsg-2+etch2_arm.deb


• Debian libaprutil1_1.2.7+dfsg-2+etch2_arm.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.7+dfsg-2+etch2_arm.deb

Debian Linux 4.0 powerpc

• Debian libaprutil1-dbg_1.2.7+dfsg-2+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.7+dfsg-2+etch2_powerpc.deb


• Debian libaprutil1-dev_1.2.7+dfsg-2+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.7+dfsg-2+etch2_powerpc.deb


• Debian libaprutil1_1.2.7+dfsg-2+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.7+dfsg-2+etch2_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-suexec-c ustom_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-suexec_2 .2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dbg _1.2.12+dfsg-7ubuntu0.1_i386.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dev _1.2.12+dfsg-7ubuntu0.1_i386.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1_1.2 .12+dfsg-7ubuntu0.1_i386.deb

Debian Linux 5.0 s/390

• Debian libaprutil1-dbg_1.2.12+dfsg-8+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-db g_1.2.12+dfsg-8+lenny2_s390.deb


• Debian libaprutil1-dev_1.2.12+dfsg-8+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1-de v_1.2.12+dfsg-8+lenny2_s390.deb


• Debian libaprutil1_1.2.12+dfsg-8+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/a/apr-util/libaprutil1_1. 2.12+dfsg-8+lenny2_s390.deb

Apple Mac OS X 10.6.1

• Apple MacOSXUpd10.6.2.dmg
  For Mac OS X v10.6.1
  http://www.apple.com/support/downloads/

MandrakeSoft Corporate Server 3.0

• Mandriva apache2-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-common-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-devel-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-manual-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_dav-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_deflate-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_disk_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_file_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_ldap-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_mem_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_proxy-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_ssl-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-modules-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-source-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr0-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability

References:

• [Apache-SVN] Revision 779880 (Matthew Palmer)
  
• Apache Portable Runtime Homepage (Apache Software Foundation)
  
• APR-util Changelog (Apache Software Foundation)
  
• CVE-2009-0023 Buffer Overflow vulnerability in Apache Portable Runtime Utility ( (Oracle)
  
• PK91241: Z/OS IBM HTTP SERVER FOR WEBSPHERE (POWERED BY APACHE) FIX PACK 6.1.0.2 (IBM)
  
• PM10658: IBM HTTP SERVER 2.0.47 CUMULATIVE INTERIM FIX (IBM)
  
• Oracle Critical Patch Update Advisory - April 2013 (Oracle)
  
• PK99477: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• PK99478: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• PK99480: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• RHSA-2009:1107 apr-util security update (Red Hat)
  
• RHSA-2009:1160 Important: httpd22 security update (Red Hat)
  
• swg24023947 IBM HTTP Server interim fix for PK91361 (IBM)