From ${URL} : The Apache Software Foundation and the Apache Portable Runtime Project are proud to announce the General Availability of version 1.6.3 of the Apache Portable Runtime library (APR), as well as version 1.6.1 of the APR Utility library (APR-util) and version 1.2.2 of the APR iconv library (APR-iconv). APR 1.6.1 release addresses one security vulnerability; CVE-2017-12618; Out-of-bounds access in corrupted SDBM database. APR-util 1.6.0 and prior failed to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service. APR-util 1.6.3 release addresses one security vulnerability; CVE-2017-12613; Out-of-bounds array deref in apr_time_exp*() functions When apr_exp_time*() or apr_os_exp_time*() functions are invoked with an invalid month field value in APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
apr was already arm64 stabled from previous bug and apr-util does not have stable arm64 keywords..
amd64 stable
ia64 stable
sparc done.
ppc/ppc64 stable
x86 stable
arm stable
Stable on alpha.
hppa stable
@maintainer(s), please drop vulnerable.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3ba92259e954426118d8f238ff53e7d632e852a1 commit 3ba92259e954426118d8f238ff53e7d632e852a1 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2019-04-20 23:57:25 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2019-04-20 23:57:25 +0000 dev-libs/apr: Security cleanup Bug: https://bugs.gentoo.org/635272 Package-Manager: Portage-2.3.64, Repoman-2.3.12 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> dev-libs/apr/Manifest | 1 - dev-libs/apr/apr-1.5.2.ebuild | 143 ------------------------------------------ 2 files changed, 144 deletions(-)
<dev-libs/apr-util-1.6.3 is gone as well.
