The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1253 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. It provides a free library of C data structures and routines.

    Security Fix(es):

    * apr: Out-of-bounds array deref in apr_time_exp*() functions (CVE-2017-12613)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016610 advisory.

    When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in     Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value     to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or     resulting in program termination, and may represent an information disclosure or denial of service     vulnerability to applications which call these APR functions with unvalidated external input.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was an out-of-bounds memory vulnerability in apr, a support/portability library for various applications.

When the apr_exp_time*() or apr_os_exp_time*() functions were invoked with an invalid month field value, out of bounds memory may have been be accessed when converting this value to an apr_time_exp_t value.
This could have potentially revealed the contents of a different static heap value or resulted in program termination.

For Debian 7 'Wheezy', this issue has been fixed in apr version 1.4.6-3+deb7u2.

We recommend that you upgrade your apr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following issues :

  - CVE-2017-12613: DoS or information disclosure in     pr_exp_time*() or apr_os_exp_time*() functions     (bsc#1064982).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has apr packages installed that are affected by a vulnerability:

  - An out-of-bounds array dereference was found in     apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of     service or potentially lead to data leak.
    (CVE-2017-12613)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2580:01 advisory.

    * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of service or potentially lead to data leak.
    (CVE-2017-12613)     CVE-2017-12613     When apr_time_exp*() or apr_os_exp_time*() functions are invoked with     an invalid month field value in Apache Portable Runtime APR 1.6.2 and     prior, out of bounds memory may be accessed in converting this value     to an apr_time_exp_t value, potentially revealing the contents of a     different static heap value or resulting in program termination, and     may represent an information disclosure or denial of service     vulnerability to applications which call these APR functions with     unvalidated external input.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3477 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of service or potentially lead to data leak.
    (CVE-2017-12613)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

    * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)

    Red Hat would like to thank Hanno Bck for reporting CVE-2017-9798.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - fpserver
  - AppleGraphicsControl
  - APR
  - ATS
  - CFNetwork
  - CoreAnimation
  - CoreCrypto
  - CoreFoundation
  - CUPS
  - Dictionary
  - dyld
  - EFI
  - Foundation
  - Grand Central Dispatch
  - Heimdal
  - Hypervisor
  - ICU
  - Intel Graphics Driver
  - IOGraphics
  - IOHIDFamily
  - IOKit
  - IOUserEthernet
  - IPSec
  - Kernel
  - Login Window
  - mDNSOffloadUserClient
  - MediaRemote
  - Microcode
  - NetworkExtension
  - Security
  - Spotlight
  - Symptom Framework
  - WiFi

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3270 advisory.

    [1.3.9-5.1]
    - Resolves: #1507346 - CVE-2017-12613 apr: Out-of-bounds array deref       in apr_time_exp*() functions

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:3270 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. It provides a free library of C data structures and routines.

    Security Fix(es):

    * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of service or potentially lead to data leak.
    (CVE-2017-12613)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the apr packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An out-of-bounds array dereference was found in     apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of     service or potentially lead to data     leak.(CVE-2017-12613)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak.(CVE-2017-12613)

The remote NewStart CGSL host, running version MAIN 5.04, has apr packages installed that are affected by a vulnerability:

  - An out-of-bounds array dereference was found in     apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of     service or potentially lead to data leak.
    (CVE-2017-12613)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* apr: Out-of-bounds array deref in apr_time_exp*() functions (CVE-2017-12613)

* tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

* tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)

* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

* tomcat-native: Mishandling of client certificates can allow for OCSP check bypass (CVE-2017-15698)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109391	RHEL 6 / 7 : apr (RHSA-2018:1253)	Nessus	Red Hat Local Security Checks	2018/4/27	2024/11/5	high
316217	Unity Linux 20.1060e / 20.1070e Security Update: apr (UTSA-2026-016610)	Nessus	Unity Linux Local Security Checks	2026/5/22	2026/5/22	high
374094	SUSE SLES12: libapr1 / libapr1-devel / libtcnative-1-0 / libtcnative-1-0-devel / etc (SUSE-SU-2026:4927-1)	Nessus	SuSE Local Security Checks	2026/10/30	2026/10/30	critical
104412	Debian DLA-1162-1 : apr security update	Nessus	Debian Local Security Checks	2017/11/7	2025/11/14	high
109889	SUSE SLES11 Security Update : libapr1 (SUSE-SU-2018:1322-1)	Nessus	SuSE Local Security Checks	2018/5/17	2024/10/4	high
127354	NewStart CGSL MAIN 4.05 : apr Vulnerability (NS-SA-2019-0115)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
290100	MiracleLinux 4 : httpd24-apr-1.5.1-1.AXS4.1 (AXSA:2018-2580:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
105369	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.23 (RHSA-2017:3477)	Nessus	Red Hat Local Security Checks	2017/12/19	2024/11/5	critical
118575	macOS 10.13.6 Multiple Vulnerabilities (Security Update 2018-002)	Nessus	MacOS X Local Security Checks	2018/10/31	2026/1/9	critical
104838	Oracle Linux 6 / 7 : apr (ELSA-2017-3270)	Nessus	Oracle Linux Local Security Checks	2017/11/29	2024/10/22	high
104842	RHEL 6 / 7 : apr (RHSA-2017:3270)	Nessus	Red Hat Local Security Checks	2017/11/29	2024/11/5	high
104922	EulerOS 2.0 SP2 : apr (EulerOS-SA-2017-1304)	Nessus	Huawei Local Security Checks	2017/12/1	2025/11/13	high
105052	Amazon Linux AMI : apr (ALAS-2017-928)	Nessus	Amazon Linux Local Security Checks	2017/12/7	2025/11/12	high
127140	NewStart CGSL MAIN 5.04 : apr Vulnerability (NS-SA-2019-0001)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
107208	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 2 (RHSA-2018:0466)	Nessus	Red Hat Local Security Checks	2018/3/8	2023/4/25	high

检测

插件搜索

high

high

critical

high

high

high

high

critical

critical

high

high

high

high

high

high