{"id":"CVE-2017-12618","aliases":["DEBIAN-CVE-2017-12618","DLA-1163-1","EUVD-2017-4172","GHSA-cxw3-v6f8-2cpm","MGASA-2017-0427","SUSE-SU-2017:3278-1","SUSE-SU-2018:0307-1","UBUNTU-CVE-2017-12618","USN-5737-1","openSUSE-SU-2024:10629-1"],"status":"published","title":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM...","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00596,"percentile":0.48773,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-10-24T01:00:00Z","modified":"2026-09-01T20:03:42Z","fixes":[{"ecosystem":"Debian:12","package":"apr-util","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apr-util","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apr-util","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"apr-util","fixed_in":["1.4.1-3+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"apr-util","fixed_in":["1.5.4-5.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"apr-util","fixed_in":["1.5.4-8.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libapr-util1","fixed_in":["1.5.3-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libapr-util1","fixed_in":["1.3.4-12.22.23.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libapr-util1","fixed_in":["1.3.4-12.22.23.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libapr-util1","fixed_in":["1.3.4-12.22.23.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Studio Onsite 1.3","package":"libapr-util1","fixed_in":["1.3.4-12.22.23.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","fixed_in":["1.5.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apr-util","fixed_in":["1.5.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apr-util","fixed_in":["1.6.1-7.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-3+deb7u1"}]}],"versions":["1.4.1-3"]},{"source":"osv","ecosystem":"Mageia:5","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-5.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-8.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-12.22.23.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-12.22.23.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-12.22.23.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-12.22.23.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm1"}]}],"versions":["1.5.2-1","1.5.2-1build1","1.5.2-2ubuntu1","1.5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu0.1~esm1"}]}],"versions":["1.5.4-1","1.5.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm1"}]}],"versions":["1.5.2-1","1.5.2-1build1","1.5.2-2ubuntu1","1.5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu0.1~esm1"}]}],"versions":["1.5.4-1","1.5.4-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-7.8"}]}]}],"products":[{"vendor":"apache","product":"portable_runtime_utility"},{"vendor":"apache software foundation","product":"apache portable runtime"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1042004","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252POs4toeJJciwg09_eu2cO3XFg%3DUqsPjXsfjDoeC3-UQ%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/101558","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12618"},{"url":"https://github.com/advisories/GHSA-cxw3-v6f8-2cpm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12618","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0427.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22054","tags":["report"]},{"url":"http://www.apache.org/dist/apr/Announcement1.x.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3Z2STTD6D27UYP6XERSJGSCPYXEZ7KN6/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1064990","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12618","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180307-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12618","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5737-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12618","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-12618","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:00:00Z","modified":"2024-08-05T18:43:56.405Z","updated_at":"2026-11-02T14:33:17.59533Z"}],"euvd":[{"id":"EUVD-2017-4172","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:00:00Z","modified":"2024-08-05T18:43:56Z","updated_at":"2026-11-03T02:23:21.159659Z"}],"ghsa":[{"id":"GHSA-cxw3-v6f8-2cpm","title":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM...","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2022-05-14T02:03:26Z","modified":"2023-02-02T05:04:48Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:57.541Z"}],"nvd":[{"id":"CVE-2017-12618","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:29:02.03Z","modified":"2026-06-17T01:03:38.587Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"CVE-2017-12618","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:29:02.03Z","modified":"2026-04-16T06:15:21.096770663Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12618","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:29:02.03Z","modified":"2026-09-01T20:03:42.290988931Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12618","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.","status":"published","published":"2017-10-24T01:29:00Z","modified":"2026-04-22T11:13:19.419265Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1163-1","title":"apr-util - security update","status":"published","published":"2017-11-06T00:00:00Z","modified":"2026-03-09T01:01:20.464793Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0427","title":"Updated apr-util packages fix security vulnerability","description":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to\nvalidate the integrity of SDBM database files used by apr_sdbm*()\nfunctions, resulting in a possible out of bound read access. A local\nuser with write access to the database can make a program or process\nusing these functions crash, and cause a denial of service\n(CVE-2017-12618).\n","status":"published","published":"2017-11-26T21:18:31Z","modified":"2026-04-16T06:23:11.445028961Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10629-1","title":"apr-util-devel-1.6.1-7.8 on GA media","description":"These are all security issues fixed in the apr-util-devel-1.6.1-7.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:33.274687Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:3278-1","title":"Security update for libapr-util1","description":"This update for libapr-util1 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-12618: DoS via crafted SDBM database files in apr_sdbm*() functions (bsc#1064990)\n","status":"published","published":"2017-12-13T16:11:00Z","modified":"2026-02-04T04:01:58.042131Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0307-1","title":"Security update for libapr-util1","description":"This update for libapr-util1 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-12618: DoS via crafted SDBM database files in apr_sdbm*() functions (bsc#1064990)\n","status":"published","published":"2018-01-30T16:37:56Z","modified":"2026-02-04T03:11:38.900666Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-5737-1","title":"apr-util vulnerability","description":"It was discovered that APR-util did not properly handle memory when using  \nSDBM database files. A local attacker with write access to the database    \ncan make a program or process using these functions crash, and cause a     \ndenial of service.\n","status":"published","published":"2022-11-23T10:09:39Z","modified":"2026-06-29T13:50:43.277752515Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}