Some vulnerabilities have been reported in APR-util, which can potentially be exploited to cause a DoS (Denial of Service) or compromise an application using the library.

1) Multiple integer overflow errors exist in the "apr_rmm_malloc()", "apr_rmm_calloc()", and "apr_rmm_realloc()" functions in misc/apr_rmm.c when aligning relocatable memory blocks, which can potentially be exploited to cause buffer overflows.

2) An error exists when handling errors in the "apr_pollset_poll()" and "apr_pollcb_poll()" functions on Solaris. This can be exploited to e.g. hang an application using the library.

NOTE: This vulnerability is not reported in 0.x versions.

Solution
-- Apache APR-util 1.x --
Further details available to Secunia VIM customers

Provided and/or discovered by
1) The vendor credits Matt Lewis.
2) Reported by HWS in an Apache bug report.

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/CHANGES?revision=800735&view=markup
http://svn.apache.org/viewvc/apr/apr-util/branches/0.9.x/CHANGES?revision=800736&view=markup
2) https://issues.apache.org/bugzilla/show_bug.cgi?id=47645

Deep Links
Links available to Secunia VIM customers