Security update for apr-util SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0325-1 Final 1 1 2023-02-08T18:15:23Z current 2023-02-08T18:15:23Z 2023-02-08T18:15:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apr-util This update for apr-util fixes the following issues: - CVE-2022-25147: Fixed a buffer overflow possible with specially crafted input during base64 encoding (bsc#1207866) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-325,SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-325,SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-325,SUSE-SLE-Product-SLES_SAP-15-SP1-2023-325 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230325-1/ Link for SUSE-SU-2023:0325-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013704.html E-Mail link for SUSE-SU-2023:0325-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207866 SUSE Bug 1207866 https://www.suse.com/security/cve/CVE-2022-25147/ SUSE CVE CVE-2022-25147 page SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 apr-util-devel-1.6.1-150000.4.9.1 libapr-util1-1.6.1-150000.4.9.1 libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 apr-util-devel-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libapr-util1-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS apr-util-devel-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libapr-util1-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS apr-util-devel-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libapr-util1-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. CVE-2022-25147 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:apr-util-devel-1.6.1-150000.4.9.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libapr-util1-1.6.1-150000.4.9.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server 15 SP1-LTSS:apr-util-devel-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libapr-util1-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:apr-util-devel-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libapr-util1-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libapr-util1-dbd-mysql-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libapr-util1-dbd-pgsql-1.6.1-150000.4.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libapr-util1-dbd-sqlite3-1.6.1-150000.4.9.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230325-1/ https://www.suse.com/security/cve/CVE-2022-25147.html CVE-2022-25147 https://bugzilla.suse.com/1207866 SUSE Bug 1207866 https://bugzilla.suse.com/1209320 SUSE Bug 1209320