Out-of-bounds read in APR-iconv and Apache Portable Runtime - CVE-2017-12613

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9477

Out-of-bounds read in APR-iconv and Apache Portable Runtime - CVE-2017-12613

Published: November 30, 2017 / Updated: February 2, 2023


Vulnerability identifier: #VU9477
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12613
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an out-of-bounds array dereference in the apr_time_exp_get() function. A remote attacker can access prior out-of-bounds memory, reveal the contents of a different static heap value and read arbitrary files or cause the application to crash.

Affected software

APR-iconv
Apache Portable Runtime
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
Amazon Linux AMI
Arch Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
macOS
Oracle Solaris
Slackware Linux
openEuler
Fedora
JBoss Core Services
IBM API Connect

libtcnative-1-0-devel
libtcnative-1-0
libtcnative-1-0-debugsource
libtcnative-1-0-debuginfo
apr
libapr1
libapr1-debugsource
libapr1-devel
libapr1-debuginfo
apr-help
apr-debugsource
apr-devel
apr-debuginfo
tomcat-admin-webapps
tomcat-javadoc
tomcat-jsp-2_3-api
tomcat-lib
tomcat
tomcat-servlet-4_0-api
tomcat-docs-webapp
tomcat-el-3_0-api
tomcat-webapps
Flex System Chassis Management Module (CMM)

How to mitigate CVE-2017-12613

Update to version 1.6.3.

APR-iconv - update to 1.2.2
Apache Portable Runtime - update to 1.6.3
IBM API Connect - update to 5.0.8.12
libtcnative-1-0-devel - update to 1.3.9-3.9.1
libtcnative-1-0 - update to 1.3.9-3.9.1
libtcnative-1-0-debugsource - update to 1.3.9-3.9.1
libtcnative-1-0-debuginfo - update to 1.3.9-3.9.1
apr - addressed in versions 1.6.3-1.fc25, 1.6.3-1.fc26, 1.6.3-1.fc27
libapr1 - update to 1.6.5-4.13.1
libapr1-debugsource - update to 1.6.5-4.13.1
libapr1-devel - update to 1.6.5-4.13.1
libapr1-debuginfo - update to 1.6.5-4.13.1
apr-help - update to 1.7.0-3
apr-debugsource - update to 1.7.0-3
apr-devel - update to 1.7.0-3
apr-debuginfo - update to 1.7.0-3
apr - update to 1.7.0-3
apr - update to 1.7.2-2
tomcat-admin-webapps - update to 9.0.123-3.182.2
tomcat-javadoc - update to 9.0.123-3.182.2
tomcat-jsp-2_3-api - update to 9.0.123-3.182.2
tomcat-lib - update to 9.0.123-3.182.2
tomcat - update to 9.0.123-3.182.2
tomcat-servlet-4_0-api - update to 9.0.123-3.182.2
tomcat-docs-webapp - update to 9.0.123-3.182.2
tomcat-el-3_0-api - update to 9.0.123-3.182.2
tomcat-webapps - update to 9.0.123-3.182.2
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
apr - update to 1.7.2

External References

Related Security Bulletins