FreeBSD Apache apr — multiple vulnerabilities

last updated in Categories Apache, FreeBSD, package management, Security Alert

Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).

Affected package: apache-2.2.11_4


A vulnerability is caused due to an error in the processing of XML files and can be exploited to exhaust all available memory via a specially crafted XML file containing a predefined entity inside an entity definition. A vulnerability is caused due to an error within the “apr_strmatch_precompile()” function in strmatch/apr_strmatch.c, which can be exploited to crash an application using the library. A single NULL byte buffer overflow flaw was found in apr-util’s apr_brigade_vprintf() function.
To Fix this issue use the following commands, it will upgrade apache and other software too:
# portsnap fetch update
# pkg_version -l '<' # portmaster -a


Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.