CVE-2022-28331

2023-01-3116:15:08

Debian Security Bug Tracker

security-tracker.debian.org

windows

apache portable runtime

stack buffer overflow

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.077

Percentile

94.3%

JSON

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

OSVersionArchitecturePackageVersionFilename
Debian12allapr< 1.7.2-3apr_1.7.2-3_all.deb
Debian11allapr< 1.7.0-6+deb11u2apr_1.7.0-6+deb11u2_all.deb
Debian999allapr< 1.7.5-1apr_1.7.5-1_all.deb
Debian13allapr< 1.7.5-1apr_1.7.5-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	apr	< 1.7.2-3	apr_1.7.2-3_all.deb
Debian	11	all	apr	< 1.7.0-6+deb11u2	apr_1.7.0-6+deb11u2_all.deb
Debian	999	all	apr	< 1.7.5-1	apr_1.7.5-1_all.deb
Debian	13	all	apr	< 1.7.5-1	apr_1.7.5-1_all.deb