CVE-2025-52434 Apache Tomcat: APR/Native Connector crash leading to DoS

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 throug...

Fixed in Apache Tomcat 9.0.107

Important: APR/Native Connector crash leading to DoS CVE-2025-52434 A race condition on connection close could trigger a JVM crash when using the APR/Native connector leading to a DoS. This was particularly noticeable with client initiated closes of HTTP/2 connections. This was fixed with commit...

The vulnerability of the apr.h component in the APR library allows a hacker to gain access to confidential data.

The vulnerability of the apr.h component in the APR library is related to the improper assignment of permissions for the critical resource. Exploiting this vulnerability may allow an attacker to access confidential data...

TencentOS Server 3: apr-util (TSSA-2023:0073)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0073 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 4: apr (TSSA-2024:0478)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0478 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Race Condition

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Race Condition on connection close when using the APR/Native connector. An attacker could trigger a JVM crash by rapidly opening and closing HTTP/2 connections...

SUSE: Security Advisory (SUSE-SU-2024:3428-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-f831fe4030)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-25832

Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication...

CVE-2025-20943

Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote...

CVE-2022-24963 affecting package apr for versions less than 1.7.2-1

CVE-2022-24963 affecting package apr for versions less than 1.7.2-1. A patched version of the package is available...

CVE-2017-12613 affecting package apr for versions less than 1.6.3-1

CVE-2017-12613 affecting package apr for versions less than 1.6.3-1. A patched version of the package is available...

Medium: apr

Issue Overview: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr...

Photon OS 4.0: Apr PHSA-2024-4.0-0711

An update of the apr package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0711. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid21139...

Critical Photon OS Security Update - PHSA-2024-4.0-0711

Updates of 'linux-aws', 'linux', 'apr', 'apache-tomcat9' packages of Photon OS have been released...

Fedora 41 : apr (2024-f831fe4030)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f831fe4030 advisory. Update APR to version 1.7.5. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

CVE-2023-49582 affecting package apr for versions less than 1.7.5-1

CVE-2023-49582 affecting package apr for versions less than 1.7.5-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024

Summary IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2024 - Includes OpenJDK Apr 2024 CPU

Summary IBM Semeru Runtime Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21085 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts...