High severity7.1NVD Advisory· Published Oct 24, 2017· Updated Jun 17, 2026
CVE-2017-12613
CVE-2017-12613
Description
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
42cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:*range: <1.7.0
- (no CPE)range: <=1.6.2
- (no CPE)range: 1.6.2 and prior
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- osv-coords7 versionspkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/libapr1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/libapr1&distro=SUSE%20Studio%20Onsite%201.3
< 1.3.3-11.18.19.13.2+ 6 more
- (no CPE)range: < 1.3.3-11.18.19.13.2
- (no CPE)range: < 1.5.1-4.3.1
- (no CPE)range: < 1.3.3-11.18.19.13.2
- (no CPE)range: < 1.5.1-4.3.1
- (no CPE)range: < 1.3.3-11.18.19.13.2
- (no CPE)range: < 1.5.1-4.3.1
- (no CPE)range: < 1.3.3-11.18.19.13.2
Patches
Vulnerability mechanics
References
21- www.apache.org/dist/apr/Announcement1.x.htmlnvdRelease NotesVendor Advisory
- www.openwall.com/lists/oss-security/2021/08/23/1nvdMailing ListThird Party Advisory
- www.securitytracker.com/id/1042004nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2017:3270nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:3475nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:3476nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:3477nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:0316nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:0465nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:0466nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:1253nvdThird Party Advisory
- lists.apache.org/thread.html/12489f2e4a9f9d390235c16298aca0d20658789de80d553513977f13%40%3Cannounce.apache.org%3EnvdIssue TrackingVendor Advisory
- lists.debian.org/debian-lts-announce/2017/11/msg00005.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/01/msg00023.htmlnvdMailing ListThird Party Advisory
- svn.apache.org/viewvcnvdIssue TrackingThird Party Advisory
- www.securityfocus.com/bid/101560nvdBroken Link
- lists.apache.org/thread.html/r270dd5022db194b78acaf509216a33c85f3da43757defa05cc766339%40%3Ccommits.apr.apache.org%3Envd
- lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3Envd
- lists.apache.org/thread.html/ra38094406cc38a05218ebd1158187feda021b0c3a1df400bbf296af8%40%3Cdev.apr.apache.org%3Envd
- lists.apache.org/thread.html/rb1f3c85f50fbd924a0051675118d1609e57957a02ece7facb723155b%40%3Cannounce.apache.org%3Envd
- lists.apache.org/thread.html/rcc48a0acebbd74bbdeebc02ff228bb72c0631b21823fffe27d4691e9%40%3Ccommits.apr.apache.org%3Envd
News mentions
0No linked articles in our index yet.