CVE-2009-2412
CVE-2009-2412 is a critical-severity vulnerability in Apache Apr-util with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 14% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-189.
Key facts
- Severity: Critical (CVSS 2.0 base score 10.0)
- EPSS exploit prediction: 14% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-189
- Affected product: Apache Apr-util
- Published:
- Last modified:
Description
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.
Frequently asked questions
- What is CVE-2009-2412?
- Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.
- How severe is CVE-2009-2412?
- CVE-2009-2412 has a CVSS 2.0 base score of 10.0, rated critical severity.
- Is CVE-2009-2412 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 14% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-2412?
- CVE-2009-2412 primarily affects Apache Apr-util. In total, 47 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-2412?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2009-2412 published?
- CVE-2009-2412 was published on 2009-08-06 and last updated on 2026-06-16.
References
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://osvdb.org/56765
- http://osvdb.org/56766
- http://secunia.com/advisories/36138
- http://secunia.com/advisories/36140
- http://secunia.com/advisories/36166
- http://secunia.com/advisories/36233
- http://secunia.com/advisories/37152
- http://secunia.com/advisories/37221
- http://support.apple.com/kb/HT3937
- http://svn.apache.org/viewvc/apr/apr-util/branches/0.9.x/CHANGES?revision=800736&view=markup
- http://svn.apache.org/viewvc/apr/apr-util/branches/0.9.x/misc/apr_rmm.c?r1=230441&r2=800736
- http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/CHANGES?revision=800735&view=markup
- http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/misc/apr_rmm.c?r1=647687&r2=800735
- http://svn.apache.org/viewvc/apr/apr/branches/0.9.x/CHANGES?revision=800733&view=markup
- http://svn.apache.org/viewvc/apr/apr/branches/0.9.x/memory/unix/apr_pools.c?r1=585356&r2=800733
- http://svn.apache.org/viewvc/apr/apr/branches/1.3.x/CHANGES?revision=800732&view=markup
- http://svn.apache.org/viewvc/apr/apr/branches/1.3.x/memory/unix/apr_pools.c?r1=678140&r2=800732
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK93225
- http://www-01.ibm.com/support/docview.wss?uid=swg1PK99482
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:195
- http://www.securityfocus.com/bid/35949
- http://www.ubuntu.com/usn/usn-813-2
- http://www.vupen.com/english/advisories/2009/3184
- http://www.vupen.com/english/advisories/2010/1107
- https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
Affected products (47)
- cpe:2.3:a:apache:apr-util:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.2-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.3-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.7-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:0.9.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.4-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.6-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:apr-util:1.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.2-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.3-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.7-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:0.9.16-dev:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:portable_runtime:1.3.3:*:*:*:*:*:*:*
More vulnerabilities in Apache Apr-util
- CVE-2009-1955 — High (CVSS 7.5): The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the…
- CVE-2009-1956 — Medium (CVSS 6.4): Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows…
- CVE-2010-1623 — Medium (CVSS 5.0): Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility…
- CVE-2011-1928 — Medium (CVSS 4.3): The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the…
- CVE-2009-0023 — Medium (CVSS 4.3): The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers…
All CVEs affecting Apache Apr-util →
Other CWE-189 (Numeric Errors) vulnerabilities
- CVE-2015-8396 — Critical (CVSS 10.0): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in…
- CVE-2015-7205 — Critical (CVSS 10.0): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x…
- CVE-2015-6575 — Critical (CVSS 10.0): SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which…
- CVE-2015-3864 — Critical (CVSS 10.0): Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in…
- CVE-2015-3836 — Critical (CVSS 10.0): The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1…
- CVE-2015-3834 — Critical (CVSS 10.0): Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android…