Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability

Bugtraq ID:	35251
Class:	Design Error
CVE:	CVE-2009-1956
Remote:	Yes
Local:	No
Published:	Jun 04 2009 12:00AM
Updated:	Apr 13 2015 08:20PM
Credit:	Unknown
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SuSE openSUSE 10.3 Sun Solaris 10_x86 Sun Solaris 10_sparc Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4.8.z RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Certificate Server 7.3 Red Hat Enterprise Linux EUS 5.3.z server Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.8.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server Pardus Linux 2008 0 Oracle Oracle HTTP Server 9.2 .8 Oracle Oracle HTTP Server 9.2 .0 + Apache Software Foundation Apache 1.3.22 Oracle Oracle HTTP Server 9.1 + Apache Software Foundation Apache 1.3.12 Oracle Oracle HTTP Server 9.0.3 .1 Oracle Oracle HTTP Server 9.0.2 .3 + Oracle Oracle9i Application Server 9.0.2 .3 Oracle Oracle HTTP Server 9.0.2 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 Oracle Oracle HTTP Server 1.0.2 .2 Roll up 2 Oracle Oracle HTTP Server 1.0.2 .2 Oracle Oracle HTTP Server 1.0.2 .1 Oracle Oracle HTTP Server 1.0.2 .0 Oracle Oracle HTTP Server 11.1.1.5 Oracle Oracle HTTP Server 11.1.1.4 Oracle Oracle HTTP Server 11.1.1.3 Oracle Oracle HTTP Server 10.1.3.5 Oracle Oracle HTTP Server 10.1.2.3 Oracle HTTP Server for Server 9.2 Oracle HTTP Server for Server 9.0.1 Oracle HTTP Server for Server 8.1.7 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM HTTP Server 6.1 .27 IBM HTTP Server 6.1 .25 IBM HTTP Server 6.1 .19 IBM HTTP Server 6.1 .17 IBM HTTP Server 6.1 .15 IBM HTTP Server 6.0.2 .35 IBM HTTP Server 6.0.2 .33 IBM HTTP Server 6.0.2 .27 IBM HTTP Server 6.0.2 .13 IBM HTTP Server 6.0.2 IBM HTTP Server 2.0.47 .1 IBM HTTP Server 2.0.47 IBM HTTP Server 7.0.0.5 IBM HTTP Server 7.0 IBM HTTP Server 6.1.0.13 IBM HTTP Server 6.1.0.1 IBM HTTP Server 6.1.0 IBM HTTP Server 6.0.2.23 IBM HTTP Server 6.0.2.19 IBM HTTP Server 6.0.2.12 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 Gentoo Linux Avaya Message Networking MN 3.1 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Communication Manager 4.0.3 SP1 Avaya Communication Manager 3.1.4 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.0 Avaya Communication Manager 1.3.1 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R11 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 1.1 Avaya Communication Manager 5.2 Avaya Communication Manager 5.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 5.0 SP3 Avaya Communication Manager 5.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 Avaya Communication Manager 2.2 Avaya Communication Manager 2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 4.0.1 Avaya Aura Application Enablement Services 4.2 Avaya Aura Application Enablement Services 4.1 Avaya Aura Application Enablement Services 4.0 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.6 Apple Mac OS X 10.5 Apache Software Foundation APR-util 1.3.4
Not Vulnerable:	IBM Websphere Application Server 7.0.0.7 Apple Mac OS X Server 10.6.2 Apple Mac OS X 10.6.2 Apache Software Foundation APR-util 1.3.5

Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability

Apache 'APR-util' is prone to an off-by-one vulnerability that may allow attackers to obtain sensitive information or trigger a denial-of-service condition.

Given the nature of this issue, attackers may also be able to execute arbitrary code in the context of an application that uses the affected library, but this has not been confirmed.

Versions prior to 'APR-util' 1.3.5 on big-endian platforms are vulnerable.

Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.9-7u buntu3.1_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.9- 7ubuntu3.1_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.9-7 ubuntu3.1_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.9- 7ubuntu3.1_powerpc.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec-custom_2.2. 9-7ubuntu3.1_powerpc.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec_2.2.9-7ubun tu3.1_powerpc.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.9 -7ubuntu3.1_powerpc.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.9-7ubunt u3.1_powerpc.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.9-7ub untu3.1_powerpc.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-7ubuntu0.1_powerpc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-7ubuntu0.1_powerpc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-7 ubuntu0.1_powerpc.deb

Slackware Linux 12.2

• Slackware httpd-2.2.12-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ httpd-2.2.12-i486-1_slack12.2.tgz

Mandriva Linux Mandrake 2008.0

• Mandriva apr-util-dbd-mysql-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apr-util-dbd-pgsql-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apr-util-dbd-sqlite3-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-devel-1.2.11-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-util-devel-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr-util1-1.2.10-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr1-1.2.11-1.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.11-2 ubuntu2.1_sparc.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.11 -2ubuntu2.1_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.11- 2ubuntu2.1_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.11 -2ubuntu2.1_sparc.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_ 2.2.11-2ubuntu2.1_sparc.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.11- 2ubuntu2.1_sparc.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.1 1-2ubuntu2.1_sparc.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.11-2ubun tu2.1_sparc.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.11-2u buntu2.1_sparc.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-8ubuntu0.1_sparc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-8ubuntu0.1_sparc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-8 ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.9-7u buntu3.1_sparc.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.9- 7ubuntu3.1_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.9-7 ubuntu3.1_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.9- 7ubuntu3.1_sparc.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec-custom_2.2. 9-7ubuntu3.1_sparc.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-suexec_2.2.9-7ubun tu3.1_sparc.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.9 -7ubuntu3.1_sparc.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.9-7ubunt u3.1_sparc.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.9-7ub untu3.1_sparc.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-7ubuntu0.1_sparc.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-7ubuntu0.1_sparc.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-7 ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.11-2 ubuntu2.1_lpia.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.11 -2ubuntu2.1_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.11- 2ubuntu2.1_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.11 -2ubuntu2.1_lpia.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_ 2.2.11-2ubuntu2.1_lpia.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.11- 2ubuntu2.1_lpia.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.1 1-2ubuntu2.1_lpia.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.11-2ubun tu2.1_lpia.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.11-2u buntu2.1_lpia.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-8ubuntu0.1_lpia.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-8ubuntu0.1_lpia.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-8 ubuntu0.1_lpia.deb

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.2.dmg
  For Mac OS X v10.6
  http://www.apple.com/support/downloads/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu apache2-doc_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 11-2ubuntu2.1_all.deb


• Ubuntu apache2-mpm-event_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-mpm-prefork_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-mpm-worker_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-prefork-dev_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-src_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-src_ 2.2.11-2ubuntu2.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suex ec-custom_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-suexec_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suex ec_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-threaded-dev_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2-utils_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2.2-common_2.2.11-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.11-2ubuntu2.1_amd64.deb


• Ubuntu apache2_2.2.11-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.11-2 ubuntu2.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dbg _1.2.12+dfsg-8ubuntu0.1_amd64.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dev _1.2.12+dfsg-8ubuntu0.1_amd64.deb


• Ubuntu libaprutil1_1.2.12+dfsg-8ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1_1.2 .12+dfsg-8ubuntu0.1_amd64.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu apache2-doc_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-mpm-event_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-mpm-prefork_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-mpm-worker_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-prefork-dev_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-src_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 9-7ubuntu3.1_all.deb


• Ubuntu apache2-suexec-custom_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-suexec-c ustom_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-suexec_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-suexec_2 .2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-threaded-dev_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2-utils_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2.2-common_2.2.9-7ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.9-7ubuntu3.1_i386.deb


• Ubuntu apache2_2.2.9-7ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.9-7u buntu3.1_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dbg _1.2.12+dfsg-7ubuntu0.1_i386.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1-dev _1.2.12+dfsg-7ubuntu0.1_i386.deb


• Ubuntu libaprutil1_1.2.12+dfsg-7ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apr-util/libaprutil1_1.2 .12+dfsg-7ubuntu0.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu apache2-doc_2.2.8-1ubuntu0.8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.8_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.8_lpia.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.8_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.8_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.8_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.8_lpia.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.8_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.8_lpia.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.8_lpia.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.8_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.8_lpia.deb


• Ubuntu apache2_2.2.8-1ubuntu0.8_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.8_all.deb


• Ubuntu libaprutil1-dbg_1.2.12+dfsg-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dbg_1.2.12+df sg-3ubuntu0.1_lpia.deb


• Ubuntu libaprutil1-dev_1.2.12+dfsg-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1-dev_1.2.12+df sg-3ubuntu0.1_lpia.deb


• Ubuntu libaprutil1_1.2.12+dfsg-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apr-util/libaprutil1_1.2.12+dfsg-3 ubuntu0.1_lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu apache2-common_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.5_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.5_i386.deb


• Ubuntu apache2_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.5_i386.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.5_i386.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.5_i386.deb

Apple Mac OS X 10.6.1

• Apple MacOSXUpd10.6.2.dmg
  For Mac OS X v10.6.1
  http://www.apple.com/support/downloads/

MandrakeSoft Corporate Server 3.0

• Mandriva apache2-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-common-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-devel-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-manual-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_dav-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_deflate-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_disk_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_file_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_ldap-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_mem_cache-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_proxy-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-mod_ssl-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-modules-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva apache2-source-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libapr0-2.0.48-6.20.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability

References:

• APR-util Changelog (Apache Software Foundation)
  
• CVE-2009-1956 Numeric Errors vulnerability in Apache Portable Runtime Utility (A (Oracle)
  
• PM10658: IBM HTTP SERVER 2.0.47 CUMULATIVE INTERIM FIX (IBM)
  
• ASA-2009-244 apr-util security update (RHSA-2009-1107) (Avaya)
  
• Oracle Critical Patch Update Advisory - April 2013 (Oracle)
  
• PK91241: Z/OS IBM HTTP SERVER FOR WEBSPHERE (POWERED BY APACHE) FIX PACK 6.1.0.2 (IBM)
  
• PK99477: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• PK99478: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• PK99480: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.7. (IBM)
  
• RHSA-2009:1107 apr-util security update (Red Hat)
  
• swg24023947 IBM HTTP Server interim fix for PK91361 (IBM)