CVE-2017-12613 Information disclosure in Apache Portable Runtime
Out-of-bounds memory access in APR time functions allows attackers to read heap memory or crash applications via invalid month inputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12613?
CVE-2017-12613 is a high-severity vulnerability in Debian Debian Linux, published on 24 Oct 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
Weakness: CWE-125
Which versions are affected by CVE-2017-12613?
It affects 11 products.
Linux distribution packages (40)
apr Red Hat:enterprise_linux:6::client | All versions | 0:1.3.9-5.el6_9.1 |
apr-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:1.3.9-5.el6_9.1 |
apr-devel Red Hat:enterprise_linux:6::client | All versions | 0:1.3.9-5.el6_9.1 |
apr Red Hat:enterprise_linux:6::computenode | All versions | 0:1.3.9-5.el6_9.1 |
apr-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:1.3.9-5.el6_9.1 |
apr-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:1.3.9-5.el6_9.1 |
apr Red Hat:enterprise_linux:6::server | All versions | 0:1.3.9-5.el6_9.1 |
apr-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:1.3.9-5.el6_9.1 |
apr-devel Red Hat:enterprise_linux:6::server | All versions | 0:1.3.9-5.el6_9.1 |
apr Red Hat:enterprise_linux:6::workstation | All versions | 0:1.3.9-5.el6_9.1 |
apr-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:1.3.9-5.el6_9.1 |
apr-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:1.3.9-5.el6_9.1 |
apr Red Hat:enterprise_linux:7::client | All versions | 0:1.4.8-3.el7_4.1 |
apr-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.4.8-3.el7_4.1 |
apr-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.4.8-3.el7_4.1 |
apr Red Hat:enterprise_linux:7::computenode | All versions | 0:1.4.8-3.el7_4.1 |
apr-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.4.8-3.el7_4.1 |
apr-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.4.8-3.el7_4.1 |
apr Red Hat:enterprise_linux:7::server | All versions | 0:1.4.8-3.el7_4.1 |
apr-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.4.8-3.el7_4.1 |
apr-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.4.8-3.el7_4.1 |
apr Red Hat:enterprise_linux:7::workstation | All versions | 0:1.4.8-3.el7_4.1 |
apr-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.4.8-3.el7_4.1 |
apr-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.4.8-3.el7_4.1 |
apr Red Hat:rhel_aus:6.4::server | All versions | 0:1.3.9-5.el6_4.1 |
apr-debuginfo Red Hat:rhel_aus:6.4::server | All versions | 0:1.3.9-5.el6_4.1 |
apr-devel Red Hat:rhel_aus:6.4::server | All versions | 0:1.3.9-5.el6_4.1 |
apr Red Hat:rhel_aus:6.5::server | All versions | 0:1.3.9-5.el6_5.1 |
apr-debuginfo Red Hat:rhel_aus:6.5::server | All versions | 0:1.3.9-5.el6_5.1 |
apr-devel Red Hat:rhel_aus:6.5::server | All versions | 0:1.3.9-5.el6_5.1 |
apr Red Hat:rhel_aus:6.6::server | All versions | 0:1.3.9-5.el6_6.1 |
apr-debuginfo Red Hat:rhel_aus:6.6::server | All versions | 0:1.3.9-5.el6_6.1 |
apr-devel Red Hat:rhel_aus:6.6::server | All versions | 0:1.3.9-5.el6_6.1 |
apr Red Hat:rhel_aus:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr-debuginfo Red Hat:rhel_aus:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr-devel Red Hat:rhel_aus:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr Red Hat:rhel_e4s:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr-debuginfo Red Hat:rhel_e4s:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr-devel Red Hat:rhel_e4s:7.2::server | All versions | 0:1.4.8-3.el7_2.1 |
apr Red Hat:rhel_eus:6.7::computenode | All versions | 0:1.3.9-5.el6_7.1 |
Products include Apache Portable Runtime, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 5 more.
How do I fix CVE-2017-12613?
Upgrade to a fixed version.
Is CVE-2017-12613 being exploited?
There is no known exploitation of CVE-2017-12613 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2022-24963 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
- CVE-2022-28331 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
- CVE-2021-35940 Regression of CVE-2017-12613
- CVE-2023-49582 Apache Portable Runtime (APR): Unexpected lax shared memory permissions
- CVE-2012-0840 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2017-12613, DLA-1162-1, DLA-2897-1, GHSA-v99m-xvmc-cgf3, MGASA-2017-0417, OESA-2021-1096 and 7 more.