NetSight
IP …
high7.1

CVE-2017-12613

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bound…

Impact

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

Affected products

VendorProductAffected versions
ApachePortable Runtime
before 1.7.0
DebianDebian Linux
Versions 7.0, 9.0
RedhatJboss Core Services
All versions
Version 1.0
RedhatJboss Enterprise Web Server
Version 3.0.0
RedhatSoftware Collections
Version 1.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.4, 6.5, 6.6, 7.2, 7.3, 7.4
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-125

References