CVE-2022-28331 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function

2023-01-3115:55:21

CWE-190

apache

www.cve.org

cve-2022-28331

apache portable runtime

windows

out-of-bounds write

apr_socket_sendv

integer overflow

9.7 High

AI Score

Confidence

High

0.054 Low

EPSS

Percentile

93.2%

JSON

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Portable Runtime (APR)",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.7.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]