DEBIAN-CVE-2009-0023
- Source
- https://security-tracker.debian.org/tracker/CVE-2009-0023
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-0023.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2009-0023
- Upstream
- Downstream
- Published
- 2009-06-08T01:00:00Z
- Modified
- 2026-09-11T06:47:25Z
- Summary
- [none]
- Details
-
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
- References
Affected packages
Debian:12 / apr-util
Package
- Name
- apr-util
- Purl
- pkg:deb/debian/apr-util?arch=source&distro=bookworm
Debian:13 / apr-util
Package
- Name
- apr-util
- Purl
- pkg:deb/debian/apr-util?arch=source&distro=trixie
Debian:14 / apr-util
Package
- Name
- apr-util
- Purl
- pkg:deb/debian/apr-util?arch=source&distro=forky