CVE-2017-12613

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-24 · updated 2026-06-17
Weakness: CWE-125

Description

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

Affected products

Apache Software Foundation Apache Portable Runtime (APR): before 1.7.0 — fixed in 1.7.0
Debian Linux: 7.0, 9.0
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Eus: 6.7, 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.4, 6.5, 6.6, 7.2, 7.3, 7.4 (+2)
RedHat Enterprise Linux Server Tus: 6.6, 7.2, 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Workstation: 6.0, 7.0
RedHat Jboss Core Services: 1.0
Red Hat JBoss Enterprise Web Server: 3.0.0
RedHat Software Collections: 1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Portable Runtime (APR) 1.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-12613 or the next vulnerability affects your stack