CVE-2023-49582

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.(CVE-2023-49582)

Root has patched CVE-2023-49582 in the apr package for Root:Debian:11. Multiple fixed versions available.

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. (CVE-2023-49582)

These are all security issues fixed in the apr-devel-1.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apr fixes the following issues:

• CVE-2023-49582: Fixed an unexpected lax shared memory permissions. (bsc#1229783)

This update for apr fixes the following issues:

• CVE-2023-49582: Fixed an unexpected lax shared memory permissions. (bsc#1229783)

This update for libapr1, libtcnative-1-0, tomcat fixes the following issues:

• CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (bsc#1282631).
• CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
• CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
• CVE-2026-75973: improper authentication when Jakarta authentication is configured with SimpleAuthConfigProvider (bsc#1282630).
• CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
• CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
• CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).
• CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack (bsc#1282627).
• CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service (bsc#1282626).
• CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail (bsc#1282625).
• CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
• CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket (bsc#1286902).
• CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623).
• CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
• CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621).
• CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled (bsc#1282620).
• CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).
• CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).
• CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
• CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
• CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
• CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).

Non security issue fixed:

• Tomcat TLS Broken - Tomcat 9.0.14 update incompatible with tomcat-native (bsc#1130843).

Changes for libapr1:

Update to 1.6.5:

• Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4
• Fix apr_parse_addr_port() regression in scope_id parsing introduced in 1.6.3
• Numerous corrections to APR poll behavior
• apr_file_trunc: Truncating a buffered file could add unexpected data after the truncate position
• apr_file_trunc: Fix an issue where reading from a buffered file after truncate could return stale data from the buffer
• apr_ipsubnet_create() now fails for an empty input string
• Fix CVE-2017-12613, out-of-bounds read in apr_time_exp*()
• Export build files find_apr.m4 and apr_common.m4
• apr_proc_mutex-pthread: Refcount shared mutexes usage to avoid destruction while still in use by some process(es)
• New APIs: apr_allocator_align(), apr_os_proc_mutex_put_ex(), apr_os_proc_mutex_get_ex(), apr_os_proc_mutex_set_ex(), apr_file_pipe_create_pools(), apr_pollcb_wakeup(), apr_pollcb_method_name(), apr_cstr_(), apr_skiplist_addne(), …

Thomas Stangner discovered a permission vulnerability in the Apache Portable Runtime (APR) library. A local attacker could possibly use this issue to read named shared memory segments, potentially exposing sensitive application data.

USN-7038-1 fixed a vulnerability in Apache Portable Runtime (APR) library. This update provides the corresponding update for Ubuntu 14.04 LTS.

Original advisory details:

Thomas Stangner discovered a permission vulnerability in the Apache Portable Runtime (APR) library. A local attacker could possibly use this issue to read named shared memory segments, potentially exposing sensitive application data.