CVE-2022-24963 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
An integer overflow in APR encoding functions allows attackers to write beyond buffer bounds, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24963?
CVE-2022-24963 is a critical vulnerability in Apache Portable Runtime (APR), published on 31 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
Weakness: CWE-190
Which versions are affected by CVE-2022-24963?
1 open source package ship an affected version, including apr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apr Bitnami | From 1.7.0 | 1.7.1 |
Linux distribution packages (8)
apr AlmaLinux:9 | All versions | 1.7.0-12.el9_3 |
apr-devel AlmaLinux:9 | All versions | 1.7.0-12.el9_3 |
apr Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-12.el9_3 |
apr-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-12.el9_3 |
apr-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-12.el9_3 |
apr-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:1.7.0-12.el9_3 |
apr Rocky Linux:9 | All versions | 0:1.7.0-12.el9_3 |
apr openSUSE:Tumbleweed | All versions | 1.7.2-1.1 |
Products include Apache Portable Runtime.
How do I fix CVE-2022-24963?
Upgrade apr to 1.7.1 or later.
Is CVE-2022-24963 being exploited?
There is no known exploitation of CVE-2022-24963 in the wild and no public exploit code.
Other vulnerabilities in Apache Portable Runtime (APR)
- CVE-2022-28331 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
- CVE-2021-35940 Regression of CVE-2017-12613
- CVE-2017-12613 Information disclosure in Apache Portable Runtime
- CVE-2023-49582 Apache Portable Runtime (APR): Unexpected lax shared memory permissions
- CVE-2012-0840 Denial of service in n/a
Sources
Also known as ALPINE-CVE-2022-24963, ALSA-2023:7711, AZL-13226, AZL-34546, BIT-apr-2022-24963, CLSA-2025-1762338135 and 13 more.