Red Hat Security AdvisoryRHSA-2024:6205
libproxy security update
Released 2024-09-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.8.8) libproxy-devel-0.4.15-5.4.el8_8
- Red Hat Enterprise Linux AppStream EUS (v.8.8) libproxy-bin-0.4.15-5.4.el8_8, libproxy-gnome-0.4.15-5.4.el8_8, libproxy-networkmanager-0.4.15-5.4.el8_8 +1
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) libproxy-0.4.15-5.4.el8_8, python3-libproxy-0.4.15-5.4.el8_8
Fixes 2 records
Priority MEDIUM 48
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03556 · Published 2020-09-29 · Fixed CWE-120
Priority MEDIUM 40
url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04367 · Published 2020-09-09 · Partial fix CWE-674
