p PatchFirst

CVE-2009-0023

CVE-2009-0023

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.

EPSS 8.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • apr-util Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.7+dfsg-1

    Update to 1.3.7+dfsg-1

  • apr-util Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.7+dfsg-1

    Update to 1.3.7+dfsg-1

  • apr-util Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.7+dfsg-1

    Update to 1.3.7+dfsg-1

Original sources

Check your server →