CVE-2010-1623

Published: Oct 4, 2010Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

Affected (45)

Products: Apache: Apr Util, Http Server

Apache

2 products

Apr Util

Http Server

Configuration A

43 vulnerable

Vulnerable Software	Affected Versions
Apache Apr Util	Up to 1.3.9
Apache Apr Util	Version 0.9.10
Apache Apr Util	Version 0.9.11
Apache Apr Util	Version 0.9.12
Apache Apr Util	Version 0.9.13
Apache Apr Util	Version 0.9.14
Apache Apr Util	Version 0.9.15
Apache Apr Util	Version 0.9.16
Apache Apr Util	Version 0.9.17
Apache Apr Util	Version 0.9.18
Apache Apr Util	Version 0.9.1
Apache Apr Util	Version 0.9.2
Apache Apr Util	Version 0.9.3
Apache Apr Util	Version 0.9.4
Apache Apr Util	Version 0.9.5
Apache Apr Util	Version 0.9.6
Apache Apr Util	Version 0.9.7
Apache Apr Util	Version 0.9.8
Apache Apr Util	Version 0.9.9
Apache Apr Util	Version 1.0.1
Apache Apr Util	Version 1.0.2
Apache Apr Util	Version 1.0
Apache Apr Util	Version 1.1.0
Apache Apr Util	Version 1.1.1
Apache Apr Util	Version 1.1.2
Apache Apr Util	Version 1.2.10
Apache Apr Util	Version 1.2.12
Apache Apr Util	Version 1.2.13
Apache Apr Util	Version 1.2.1
Apache Apr Util	Version 1.2.2
Apache Apr Util	Version 1.2.6
Apache Apr Util	Version 1.2.7
Apache Apr Util	Version 1.2.8
Apache Apr Util	Version 1.2.9
Apache Apr Util	Version 1.3.0
Apache Apr Util	Version 1.3.1
Apache Apr Util	Version 1.3.2
Apache Apr Util	Version 1.3.3
Apache Apr Util	Version 1.3.4
Apache Apr Util	Version 1.3.5
Apache Apr Util	Version 1.3.6
Apache Apr Util	Version 1.3.7
Apache Apr Util	Version 1.3.8

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.0.35 to 2.0.64
Apache Http Server	From 2.2.0 to 2.2.17

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (118)

http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=130168502603566&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/41701

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42015

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42361

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42367

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42403

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42537

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43211

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43285

Source: secalert@redhat.com

Vendor Advisory

http://security-tracker.debian.org/tracker/CVE-2010-1623

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://svn.apache.org/viewvc?view=revision&revision=1003492

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=1003493

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=1003494

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=1003495

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=1003626

Source: secalert@redhat.com

Patch

http://ubuntu.com/usn/usn-1021-1

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601

Source: secalert@redhat.com

Third Party Advisory

http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3

Source: secalert@redhat.com

URL Repurposed

http://www.mandriva.com/security/advisories?name=MDVSA-2010:192

Source: secalert@redhat.com

URL Repurposed

http://www.redhat.com/support/errata/RHSA-2010-0950.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2011-0897.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/43673

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1022-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2556

Source: secalert@redhat.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/2557

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/2806

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/3064

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/3065

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/3074

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0358

Source: secalert@redhat.com

Vendor Advisory

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak