Описание
Security update for apr-util
This update for apr-util fixes the following issues:
- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
- CVE-2026-32327: XML stack recursion crash (bsc#1274235).
- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Список пакетов
Container suse/manager/4.3/proxy-httpd:latest
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:3937-1
- E-Mail link for SUSE-SU-2026:3937-1
- SUSE Security Ratings
- SUSE Bug 1207866
- SUSE Bug 1274235
- SUSE Bug 1274237
- SUSE Bug 1274850
- SUSE Bug 1274852
- SUSE Bug 1274854
- SUSE CVE CVE-2022-25147 page
- SUSE CVE CVE-2025-49506 page
- SUSE CVE CVE-2026-32327 page
- SUSE CVE CVE-2026-34191 page
- SUSE CVE CVE-2026-34501 page
- SUSE CVE CVE-2026-34502 page
Описание
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
Затронутые продукты
Ссылки
- CVE-2022-25147
- SUSE Bug 1207866
- SUSE Bug 1209320
Описание
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Затронутые продукты
Ссылки
- CVE-2025-49506
- SUSE Bug 1274237
Описание
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Затронутые продукты
Ссылки
- CVE-2026-32327
- SUSE Bug 1274235
Описание
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Затронутые продукты
Ссылки
- CVE-2026-34191
- SUSE Bug 1274850
Описание
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-34501
- SUSE Bug 1274852
Описание
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
Затронутые продукты
Ссылки
- CVE-2026-34502
- SUSE Bug 1274854