Debian Security Advisory 1854-1 – Matt Lewis discovered that the memory management code in the Apache Portable Runtime (APR) library does not guard against a wrap-around during size computations. This could cause the library to return a memory area which smaller than requested, resulting a heap overflow and possibly arbitrary code execution.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/80246/dsa-1854-1.txt
Source: https://packetstormsecurity.com/files/80246/Debian-Linux-Security-Advisory-1854-1.html