apr-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From William A Rowe Jr <wr...@rowe-clan.net>
Subject [Announce] Apache Portable Runtime APR 1.6.3, APR-util 1.6.1 and APR-iconv 1.2.2 Released
Date Mon, 23 Oct 2017 18:27:59 GMT
[Announce] Apache Portable Runtime APR 1.6.3, APR-util 1.6.1 and
APR-iconv 1.2.2 Released

The Apache Software Foundation and the Apache Portable Runtime
Project are proud to announce the General Availability of version
1.6.3 of the Apache Portable Runtime library (APR), as well as
version 1.6.1 of the APR Utility library (APR-util) and version
1.2.2 of the APR iconv library (APR-iconv).

APR 1.6.1 release addresses one security vulnerability;

  CVE-2017-12618; Out-of-bounds access in corrupted SDBM database.

  APR-util 1.6.0 and prior failed to validate the integrity of SDBM
  database files used by apr_sdbm*() functions, resulting in a
  possible out of bound read access. A local user with write access
  to the database can make a program or process using these functions
  crash, and cause a denial of service.

APR-util 1.6.3 release addresses one security vulnerability;

  CVE-2017-12613; Out-of-bounds array deref in apr_time_exp*() functions

  When apr_exp_time*() or apr_os_exp_time*() functions are invoked
  with an invalid month field value in APR 1.6.2 and prior, out of
  bounds memory may be accessed in converting this value to an
  apr_time_exp_t value, potentially revealing the contents of a
  different static heap value or resulting in program termination,
  and may represent an information disclosure or denial of service
  vulnerability to applications which call these APR functions with
  unvalidated external input.

There are a number of specific changes in how APR is deployed
and how APR-util deals with external dependencies in their 1.6
releases, which may be disruptive to existing build strategies:

 - Expat sources are no longer bundled, this is now an external
   dependency. Install libexpat runtime (usually installed by
   default) and development packages using your system's package
   manager, or from <https://libexpat.github.io/>.

 - MySQL support is updated as advised by the MySQL developers.
   MySQL versions older than 5.5 should not be used. If you do
   use an old MySQL version, use the thread-safe libmysqlclient_r
   version of the library.

 - FreeTDS partial and incomplete support has been dropped.
   Users of MSSQL and SYBASE databases are recommended to use
   the ODBC driver instead.

APR 1.6.3, APR-util 1.6.1, and APR-iconv 1.2.2 releases also fix
a number of run-time and build-time issues; For details, see;

  http://www.apache.org/dist/apr/CHANGES-APR-1.6
  http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6
  http://www.apache.org/dist/apr/CHANGES-APR-ICONV-1.2

APR, APR-util and APR-iconv are available for download from:

  http://apr.apache.org/download.cgi

The mission of the Apache Portable Runtime Project is to create
and maintain software libraries that provide a predictable and
consistent interface to underlying platform-specific
implementations. The primary goal is to provide an API to
which software developers may code and be assured of predictable
if not identical behavior regardless of the platform on which
their software is built. We list all known projects using APR
at http://apr.apache.org/projects.html - so please let us know
if you find our libraries useful in your own projects!

Mime
View raw message