CVE-2023-49582
CVE-2023-49582 · Apache Portable Runtime (APR): Unexpected lax shared memory permissions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.
CVSS 5.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache portable runtime (apr)
- Versions
- ≥ 0.9.0, ≤ 1.7.4: Affected (semver)
No fix published
apr Debian:12
- Versions
- 1.7.2-3
- Affected ranges
- ECOSYSTEM: < 1.7.2-3+deb12u1
Update to 1.7.2-3+deb12u1
apr Debian:13
- Affected ranges
- ECOSYSTEM: < 1.7.5-1
Update to 1.7.5-1
apr Debian:14
- Affected ranges
- ECOSYSTEM: < 1.7.5-1
Update to 1.7.5-1
apr Ubuntu:Pro:14.04:LTS
- Versions
- 1.4.8-1ubuntu1
- 1.4.8-2
- 1.4.8-3
- 1.5.0-1
- 1.5.0-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 1.5.0-1ubuntu0.1~esm2
Update to 1.5.0-1ubuntu0.1~esm2
apr Ubuntu:Pro:16.04:LTS
- Versions
- 1.5.2-3
- 1.5.2-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 1.5.2-3ubuntu0.1~esm2
Update to 1.5.2-3ubuntu0.1~esm2
apr Ubuntu:Pro:18.04:LTS
- Versions
- 1.6.2-1
- 1.6.3-1
- 1.6.3-2
- Affected ranges
- ECOSYSTEM: < 1.6.3-2ubuntu0.1~esm1
Update to 1.6.3-2ubuntu0.1~esm1
apr Ubuntu:20.04:LTS
- Versions
- 1.6.5-1
- 1.6.5-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.6.5-1ubuntu1.1
Update to 1.6.5-1ubuntu1.1
apr Ubuntu:22.04:LTS
- Versions
- 1.7.0-6ubuntu1
- 1.7.0-8
- 1.7.0-8build1
- 1.7.0-8ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: < 1.7.0-8ubuntu0.22.04.2
Update to 1.7.0-8ubuntu0.22.04.2
apr Ubuntu:24.04:LTS
- Versions
- 1.7.2-3
- 1.7.2-3.1build1
- 1.7.2-3.1build2
- Affected ranges
- ECOSYSTEM: < 1.7.2-3.1ubuntu0.1
Update to 1.7.2-3.1ubuntu0.1