CVE catalog

CVE-2023-49582

APR vulnerability

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: Jan 1, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 25, 2026

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	apr	sid	`1.7.6-3`	fixed
Debian	apr	forky	`1.7.6-3`	fixed
Debian	apr	trixie	`1.7.5-1`	fixed
Debian	apr	bookworm	`1.7.2-3+deb12u1`	fixed
Ubuntu	apr	noble	`1.7.2-3+deb12u1`	fixed
Ubuntu	apr	noble	`1.7.2-3.1ubuntu0.1`	fixed
Ubuntu	libapr1-dev	noble	`1.7.2-3.1ubuntu0.1`	fixed
Ubuntu	libapr1t64	noble	`1.7.2-3.1ubuntu0.1`	fixed
Alpine	apr	3.17	`1.7.5-r0`	fixed
Alpine	apr	3.18	`1.7.5-r0`	fixed
Alpine	apr	3.19	`1.7.5-r0`	fixed
Alpine	apr	3.20	`1.7.5-r0`	fixed
Alpine	apr	3.21	`1.7.5-r0`	fixed
Alpine	apr	3.22	`1.7.5-r0`	fixed
Alpine	apr	3.23	`1.7.5-r0`	fixed
Alpine	apr	3.24	`1.7.5-r0`	fixed
Ubuntu	apr	pro	`1.4.8-1ubuntu1`	vulnerable
Ubuntu	apr	pro	`1.4.8-2`	vulnerable
Ubuntu	apr	pro	`1.4.8-3`	vulnerable
Ubuntu	apr	pro	`1.5.0-1`	vulnerable
Ubuntu	apr	pro	`1.5.0-1ubuntu0.1~esm1`	vulnerable
Ubuntu	apr	pro	`1.5.0-1ubuntu0.1~esm2`	fixed
Ubuntu	apr	pro	`1.6.2-1`	vulnerable
Ubuntu	apr	pro	`1.6.3-1`	vulnerable
Ubuntu	apr	pro	`1.6.3-2`	vulnerable
Ubuntu	apr	pro	`1.6.3-2ubuntu0.1~esm1`	fixed
Ubuntu	apr	20.04	`1.6.5-1`	vulnerable
Ubuntu	apr	20.04	`1.6.5-1ubuntu1`	vulnerable
Ubuntu	apr	20.04	`1.6.5-1ubuntu1.1`	fixed
Ubuntu	apr	22.04	`1.7.0-6ubuntu1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8build1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8ubuntu0.22.04.1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8ubuntu0.22.04.2`	fixed
Ubuntu	apr	24.04	`1.7.2-3`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1build1`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1build2`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1ubuntu0.1`	fixed
Ubuntu	apr	pro	`1.6.2-1`	vulnerable
Ubuntu	apr	pro	`1.6.3-1`	vulnerable
Ubuntu	apr	pro	`1.6.3-2`	vulnerable
Ubuntu	apr	pro	`1.6.3-2ubuntu0.1~esm1`	fixed
Ubuntu	apr	20.04	`1.6.5-1`	vulnerable
Ubuntu	apr	20.04	`1.6.5-1ubuntu1`	vulnerable
Ubuntu	apr	20.04	`1.6.5-1ubuntu1.1`	fixed
Ubuntu	apr	22.04	`1.7.0-6ubuntu1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8build1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8ubuntu0.22.04.1`	vulnerable
Ubuntu	apr	22.04	`1.7.0-8ubuntu0.22.04.2`	fixed
Ubuntu	apr	24.04	`1.7.2-3`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1build1`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1build2`	vulnerable
Ubuntu	apr	24.04	`1.7.2-3.1ubuntu0.1`	fixed
Suse	apr	linux enterprise module for basesystem 15 sp5	`1.6.3-150000.3.6.1`	fixed
Suse	apr	linux enterprise module for basesystem 15 sp6	`1.6.3-150000.3.6.1`	fixed
Opensuse	apr	leap 15.5	`1.6.3-150000.3.6.1`	fixed
Opensuse	apr	leap 15.6	`1.6.3-150000.3.6.1`	fixed
Suse	libapr1	linux enterprise software development kit 12 sp5	`1.5.1-4.8.1`	fixed
Suse	libapr1	linux enterprise server 12 sp5	`1.5.1-4.8.1`	fixed
Suse	libapr1	linux enterprise server for sap applications 12 sp5	`1.5.1-4.8.1`	fixed
Opensuse	apr	tumbleweed	`1.7.5-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	apr	source	sid	`1.7.5-1`	not yet assigned	Not reported	[1080375]
Debian	apr	source	forky	`1.7.5-1`	not yet assigned	Not reported	[1080375]
Debian	apr	source	trixie	`1.7.5-1`	not yet assigned	Not reported	[1080375]
Debian	apr	source	bookworm	`1.7.2-3+deb12u1`	not yet assigned	Not reported	[1080375]
Ubuntu	apr	deb	noble	`1.7.2-3+deb12u1`	Not reported	Not reported	Not reported
Ubuntu	apr	deb	noble	`1.7.2-3.1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libapr1-dev	deb	noble	`1.7.2-3.1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	libapr1t64	deb	noble	`1.7.2-3.1ubuntu0.1`	Not reported	Not reported	Not reported
Alpine	apr	apk	3.17	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.18	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.19	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.20	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.21	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.22	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.23	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Alpine	apr	apk	3.24	`1.7.5-r0`	Not reported	ALPINE-CVE-2023-49582	Not reported
Ubuntu	apr	deb	pro	`1.5.0-1ubuntu0.1~esm2`	Not reported	USN-7038-2	Not reported
Ubuntu	apr	deb	pro	`1.6.3-2ubuntu0.1~esm1`	Not reported	USN-7038-1	Not reported
Ubuntu	apr	deb	20.04	`1.6.5-1ubuntu1.1`	Not reported	USN-7038-1	Not reported
Ubuntu	apr	deb	22.04	`1.7.0-8ubuntu0.22.04.2`	Not reported	USN-7038-1	Not reported
Ubuntu	apr	deb	24.04	`1.7.2-3.1ubuntu0.1`	Not reported	USN-7038-1	Not reported
Ubuntu	apr	deb	pro	`1.6.3-2ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2023-49582	Not reported
Ubuntu	apr	deb	20.04	`1.6.5-1ubuntu1.1`	Not reported	UBUNTU-CVE-2023-49582	Not reported
Ubuntu	apr	deb	22.04	`1.7.0-8ubuntu0.22.04.2`	Not reported	UBUNTU-CVE-2023-49582	Not reported
Ubuntu	apr	deb	24.04	`1.7.2-3.1ubuntu0.1`	Not reported	UBUNTU-CVE-2023-49582	Not reported
Suse	apr	rpm	linux enterprise module for basesystem 15 sp5	`1.6.3-150000.3.6.1`	Not reported	SUSE-SU-2024:3428-1	Not reported
Suse	apr	rpm	linux enterprise module for basesystem 15 sp6	`1.6.3-150000.3.6.1`	Not reported	SUSE-SU-2024:3428-1	Not reported
Opensuse	apr	rpm	leap 15.5	`1.6.3-150000.3.6.1`	Not reported	SUSE-SU-2024:3428-1	Not reported
Opensuse	apr	rpm	leap 15.6	`1.6.3-150000.3.6.1`	Not reported	SUSE-SU-2024:3428-1	Not reported
Suse	libapr1	rpm	linux enterprise software development kit 12 sp5	`1.5.1-4.8.1`	Not reported	SUSE-SU-2024:3429-1	Not reported
Suse	libapr1	rpm	linux enterprise server 12 sp5	`1.5.1-4.8.1`	Not reported	SUSE-SU-2024:3429-1	Not reported
Suse	libapr1	rpm	linux enterprise server for sap applications 12 sp5	`1.5.1-4.8.1`	Not reported	SUSE-SU-2024:3429-1	Not reported
Opensuse	apr	rpm	tumbleweed	`1.7.5-1.1`	Not reported	OPENSUSE-SU-2024:14347-1	Not reported

[Debian bug #1080375]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[apr-devel]Unknown
Source package: [apr]
Details (1)
- 1.7.6-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.7.5-1.1
  Version impact unknown
  usn · apr · opensuse · tumbleweed
[libapr1-0]Unknown
Source package: [apr]
Details (1)
- 1.7.6-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.7.5-1.1
  Version impact unknown
  usn · apr · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libapr1]Fixed
Source package: [apr]
Details (2)
- 1.7.2-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.7.2-3+deb12u1
  usn · apr · debian · bookworm; usn · apr · debian · 12
- 1.7.2-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.7.2-3+deb12u1
  usn · apr · debian · bookworm; usn · apr · debian · 12
[libapr1-dev]Fixed
Source package: [apr]
Details (2)
- 1.7.2-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.7.2-3+deb12u1
  usn · apr · debian · bookworm; usn · apr · debian · 12
- 1.7.2-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.7.2-3+deb12u1
  usn · apr · debian · bookworm; usn · apr · debian · 12

[Debian 13 (Trixie)]

[libapr1-dev]Fixed
Source package: [apr]
Details (2)
- 1.7.5-1 · amd64 · trixie
  Fixed · Fixed: 1.7.5-1
  usn · apr · debian · 13
- 1.7.5-1 · arm64 · trixie
  Fixed · Fixed: 1.7.5-1
  usn · apr · debian · 13
[libapr1t64]Fixed
Source package: [apr]
Details (2)
- 1.7.5-1 · amd64 · trixie
  Fixed · Fixed: 1.7.5-1
  usn · apr · debian · 13
- 1.7.5-1 · arm64 · trixie
  Fixed · Fixed: 1.7.5-1
  usn · apr · debian · 13

Observed: Oct 27, 2026, 2:15:32 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]