CVE Feed

Dashboard / CVE / CVE-2010-1623

CVE-2010-1623

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

Published:Oct 1, 2010

Last Modified:Apr 11, 2025

EPS:Oct 4, 2010

EPSS Score:0.17875

CVSS Score:5

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Apr-util

Apache

Apr-util

Vendor

Apache

Product

Http Server

Apache

Http Server

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Enterprise Web Server

Redhat

Jboss Enterprise Web Server

Exploits

No exploit reference

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

Related CVEs

CVE-2025-49506 (CVSS 7.5) — APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to h…

CVE-2026-34191 (CVSS 9.1) — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache P…

CVE-2026-34501 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects …

CVE-2026-34502 (CVSS 7.5) — Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affec…

CVE-2011-1928 (CVSS 4.3) — The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and …

CVE-2009-2412 (CVSS 10) — Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility librar…

CVE-2009-0023 (CVSS 4.3) — The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote …

CVE-2009-1955 (CVSS 7.5) — The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in t…

CVE-2009-1956 (CVSS 6.4) — Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms a…

References

http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

http://marc.info/?l=bugtraq&m=130168502603566&w=2

http://secunia.com/advisories/41701

http://secunia.com/advisories/42015

http://secunia.com/advisories/42361

http://secunia.com/advisories/42367

http://secunia.com/advisories/42403

http://secunia.com/advisories/42537

http://secunia.com/advisories/43211

http://secunia.com/advisories/43285

http://security-tracker.debian.org/tracker/CVE-2010-1623

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828

http://svn.apache.org/viewvc?view=revision&revision=1003492

http://svn.apache.org/viewvc?view=revision&revision=1003493

http://svn.apache.org/viewvc?view=revision&revision=1003494

http://svn.apache.org/viewvc?view=revision&revision=1003495

http://svn.apache.org/viewvc?view=revision&revision=1003626

http://ubuntu.com/usn/usn-1021-1

http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601

http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3

http://www.mandriva.com/security/advisories?name=MDVSA-2010:192

http://www.redhat.com/support/errata/RHSA-2010-0950.html

http://www.redhat.com/support/errata/RHSA-2011-0896.html

http://www.redhat.com/support/errata/RHSA-2011-0897.html

http://www.securityfocus.com/bid/43673

http://www.ubuntu.com/usn/USN-1022-1

http://www.vupen.com/english/advisories/2010/2556

http://www.vupen.com/english/advisories/2010/2557

http://www.vupen.com/english/advisories/2010/2806

http://www.vupen.com/english/advisories/2010/3064

http://www.vupen.com/english/advisories/2010/3065

http://www.vupen.com/english/advisories/2010/3074

http://www.vupen.com/english/advisories/2011/0358

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800

http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049885.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049939.html

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html

http://marc.info/?l=bugtraq&m=130168502603566&w=2

http://secunia.com/advisories/41701

http://secunia.com/advisories/42015

http://secunia.com/advisories/42361

http://secunia.com/advisories/42367

http://secunia.com/advisories/42403

http://secunia.com/advisories/42537

http://secunia.com/advisories/43211

http://secunia.com/advisories/43285

http://security-tracker.debian.org/tracker/CVE-2010-1623

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.627828

http://svn.apache.org/viewvc?view=revision&revision=1003492

http://svn.apache.org/viewvc?view=revision&revision=1003493

http://svn.apache.org/viewvc?view=revision&revision=1003494

http://svn.apache.org/viewvc?view=revision&revision=1003495

http://svn.apache.org/viewvc?view=revision&revision=1003626

http://ubuntu.com/usn/usn-1021-1

http://www-01.ibm.com/support/docview.wss?uid=swg1PM31601

http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3

http://www.mandriva.com/security/advisories?name=MDVSA-2010:192

http://www.redhat.com/support/errata/RHSA-2010-0950.html

http://www.redhat.com/support/errata/RHSA-2011-0896.html

http://www.redhat.com/support/errata/RHSA-2011-0897.html

http://www.securityfocus.com/bid/43673

http://www.ubuntu.com/usn/USN-1022-1

http://www.vupen.com/english/advisories/2010/2556

http://www.vupen.com/english/advisories/2010/2557

http://www.vupen.com/english/advisories/2010/2806

http://www.vupen.com/english/advisories/2010/3064

http://www.vupen.com/english/advisories/2010/3065

http://www.vupen.com/english/advisories/2010/3074

http://www.vupen.com/english/advisories/2011/0358

https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12800

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High